Stolen Session Token Import via Device Code Lab Token Panel

Smarth Arora@smarthxarora

•updated Jul 6, 2026•1•0•4

This rule detects unauthorized requests to the '/api/tokens/import/txt' endpoint, which is associated with the 'Device Code Lab' token management panel. Such activity is indicative of an attacker importing stolen session tokens to maintain persistent access to a compromised environment.