Most Popular 2026 Detection — Session Token Replay from New Device/IP Without Ma
Detects the use of anomalous session tokens in Azure Active Directory (Azure AD) sign-in events where the token is being used in a non-interactive manner without a corresponding interactive authentication event. This behavior is indicative of token theft or infostealer activity, where an adversary replays a stolen session cookie from a new, untrusted, or non-compliant device to bypass authentication protections.
Sigma
