Pass-the-PRT: Anomalous Device/IP Reuse of Primary Refresh Token

Ankit Mehta@Secvyn

•updated Sep 11, 2026•1•0•2

This rule detects authentication events occurring from devices that have not been seen in the user's history over the previous 14 days and involve non-compliant, unmanaged, or non-Azure AD joined devices. The detection specifically looks for sign-ins that do not utilize interactive credential prompts (token-based), which may indicate an adversary using a stolen session token (e.g., a Primary Refresh Token) from an unrecognized or insecure source.