AiTM Session Replay: Entra Sign-in Followed by Token Use from Different IP
Detects successful interactive sign-ins followed by non-interactive session replays using the same SessionId from a different IP address and country within 60 minutes, which is indicative of an Adversary-in-the-Middle (AiTM) phishing attack and subsequent session hijacking.
Microsoft Sentinel (KQL)
