2026 Critical Enterprise Intrusion Chain Detection: Impossible Travel Sign-In Following Stolen Session Cookie Replay
Detects anomalous Entra ID sign-in patterns indicating potential session hijacking or stolen session cookie replay. The rule identifies pairs of successful sign-ins where the geographic distance and time elapsed suggest impossible travel, or where the device/browser context changes without a fresh MFA challenge, suggesting the bypass of authentication requirements via persistent session tokens.
Microsoft Sentinel (KQL)
