AitM token replay: successful sign-in from new IP shortly after MFA sign-in
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Microsoft Sentinel (KQL)
