Azure AD Session Token Theft - Multi-Subnet Non-Interactive Auth (T1539)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•6

This rule detects anomalous Azure AD sign-in behavior where a single user account authenticates from two or more distinct subnets (class C) within a 10-minute window. It specifically focuses on non-interactive logins or token issuance (e.g., refresh tokens) that are successful (resultType 0) and ignores service principal activity, which may indicate account compromise, session hijacking, or automated credential misuse.