M365 session token replay via residential proxy (NodeMaven-style ASN)
Detects Microsoft Entra ID sign-in events where a user authenticates from a known residential proxy ASN, matching the user's historical geography but using a new, unrecognized device fingerprint. This behavior is indicative of session token replay attacks, where an adversary uses stolen session cookies to bypass standard authentication.
Microsoft Sentinel (KQL)
