Workday Payroll Direct Deposit Change After M365 Token Replay (Payroll Pirate)
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
Splunk (SPL)
