Refresh Token Redeemed Across FOCI Family for a High-Privilege Client Immediately After a CA Block

Ankit Mehta@Secvyn

•updated Aug 7, 2026•5•0•2

This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.