Session Token Theft - Non-Interactive Sign-in from New Geography Without MFA

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•9

This rule detects potential session token theft or replay attacks by identifying non-interactive sign-in events that occur from a different IP or geographic location than the user's most recent successful MFA-authenticated interactive session. It flags cases where a non-interactive token is used within a short timeframe (1 hour) of an interactive session from a different location, which may indicate the exfiltration and subsequent use of session cookies or OAuth tokens.