Pass-the-Cookie: ESTSAUTH Session Reuse Without Re-Authentication

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•1

Detects anomalous, non-interactive sign-in activity in Microsoft 365 that suggests session cookie replay (Pass-the-Cookie). The rule correlates successful, MFA-validated interactive sign-ins against subsequent, non-interactive sign-ins that lack MFA, occur from a different device and IP address within a short time window, and bypass standard interactive re-authentication.