FOCI Token Exchange to First-Party Apps

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•6

Detects the exchange of FOCI refresh tokens across the Microsoft app family, a tactic utilized by Tycoon 2FA. This KQL query identifies successful sign-ins where a single user's session (CorrelationId) interacts with more than 3 distinct applications within a 5-minute window, indicating potential token abuse.