Anomalous token-based sign-in to code/chat/cloud-dev apps after new location

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

This rule detects non-interactive authentication attempts to key development and collaboration platforms (e.g., GitHub, GitLab, Slack, Azure DevOps) from IP addresses or locations that have not been observed in the user's interactive sign-in history over the past 14 days. This behavior is indicative of potential session or refresh token theft, where an adversary replays stolen browser cookies from a different infrastructure to bypass traditional authentication.