Azure AD Sign-in via Suspicious Proxy User-Agent (Token Replay)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•10

Detects Azure AD sign-in events where the user-agent matches common scripting or automation libraries such as python-requests. This behavior is often indicative of automated token replay attacks, where attackers attempt to leverage stolen session cookies or tokens (e.g., following AiTM phishing) via proxy infrastructure.