Tycoon2FA - Impossible Travel Session Replay (T1539)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•4•0•9

Identifies anomalous session cookie replays where a user token logs in without interactive MFA from an entirely different geographic location within minutes. This rule specifically looks for non-interactive sessions (IsInteractive == false) where a single AccountUpn (user) has IP addresses from two or more distinct geographic locations within a 30-minute window.