AiTM - Evilginx Session Cookie Hijack (T1539)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•9•0•15

Identifies anomalous session cookie replays where a user token is suddenly used from an entirely different geographic location or ISP within minutes. This rule specifically looks for non-interactive sign-ins (indicating session cookie reuse) where a single AccountUpn shows sign-ins from at least two different IP addresses and two different geographic locations within a 10-minute window.