Session cookie replay after AiTM relay of M365 MFA authentication

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a pattern where a successful multi-factor authentication sign-in event is quickly followed by another successful sign-in for the same user from a different IP address, device, or geographic location. This behavior is indicative of session cookie theft and replay, commonly associated with phishing toolkits like Evilginx or NovaCookies.