Session token reuse from new IP after interactive sign-in (stolen token)
Detects potential stolen or replayed session tokens in Microsoft Entra ID (Azure AD) where the same SessionId is used from an IP address and ASN different from the interactive sign-in, without a fresh interactive authentication step.
Microsoft Sentinel (KQL)
