AiTM Persistence: Token Replay Followed by Device/WHfB Registration

Ankit Mehta@Secvyn

•updated Sep 3, 2026•4•0•8

This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.