Storm-2755 - Session Cookie Hijack to HR Portal (T1539)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•6

Identifies an Azure Active Directory (AAD) sign-in using a session token from an anomalous location accessing Workday/ADP SSO endpoints. This rule specifically looks for non-interactive sign-ins to Workday or ADP applications where the user's sign-in locations change rapidly (multiple distinct locations within a 10-minute window), which could indicate a session cookie hijack.