M365 Session Token Replay via Residential Proxy Networks

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•8

This rule detects potentially malicious Microsoft 365 sign-in events characterized by the use of residential proxy network providers commonly associated with session hijacking activities. It specifically flags sessions that were allowed without a Multi-Factor Authentication (MFA) challenge, suggesting the use of an already authenticated stolen session token.