Stolen Session Cookie Replay MFA Bypass - New Device SSO Login
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
Microsoft Sentinel (KQL)
