Detect Microsoft Entra ID Session Token Theft and Replay in Google Chronicle
Session token theft (also called token replay or pass-the-cookie) is one of the most prevalent identity attacks targeting Microsoft 365 and Entra ID in 2025-2026. Adversaries use adversary-in-the-middle (AiTM) proxy frameworks (Evilginx2, Modlishka, Muraena, Tycoon 2FA, EvilProxy) to intercept valid session cookies from M365 sign-in flows, then replay those cookies to authenticate as the victim without needing their credentials or MFA code. The attack works because Microsoft's authentication cookies are bound to the browser session but not to the originating IP — replaying the cookie from a different IP is detected by Entra ID's risk engine but is not blocked by default. Scattered Spider and Storm-0539 are documented using this technique at scale against SMBs and mid-market organisations, primarily targeting financial fraud (payment diversion, payroll fraud) and IT admin compromise to then facilitate SIM swapping.
MITRE ATT&CK
- Tactic
- Credential Access Defense Evasion
YARA-L Detection Query
rule entra_id_token_theft_replay {
meta:
author = "df00tech"
description = "Detects Entra ID session token theft and replay (AiTM) via impossible travel or MFA downgrade from a new IP"
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Credential Access, Lateral Movement"
mitre_attack_technique = "T1539, T1550.004"
reference = "https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec/"
threat_actors = "Scattered Spider, Storm-0539, Midnight Blizzard"
events:
// First sign-in event (baseline)
$signin1.metadata.event_type = "USER_LOGIN"
$signin1.metadata.product_name = "Azure Active Directory"
$signin1.outcome.result = "SUCCESS"
$signin1.principal.user.email_addresses[0] = $user
$signin1.principal.ip = $ip1
$signin1.principal.location.country_or_region = $loc1
// Second sign-in event (suspicious)
$signin2.metadata.event_type = "USER_LOGIN"
$signin2.metadata.product_name = "Azure Active Directory"
$signin2.outcome.result = "SUCCESS"
$signin2.principal.user.email_addresses[0] = $user
$signin2.principal.ip = $ip2
$signin2.principal.location.country_or_region = $loc2
// Temporal ordering and impossible travel conditions
$signin2.metadata.event_timestamp.seconds > $signin1.metadata.event_timestamp.seconds
($signin2.metadata.event_timestamp.seconds - $signin1.metadata.event_timestamp.seconds) < 3600
($signin2.metadata.event_timestamp.seconds - $signin1.metadata.event_timestamp.seconds) > 60
$ip1 != $ip2
$loc1 != $loc2
match:
$user over 1h
condition:
$signin1 and $signin2
}YARA-L 2.0 rule for Google Chronicle (SIEM) that detects Entra ID session token theft and replay. Correlates two successful Azure AD login events for the same user within a 1-hour window where the source IPs and geographic locations differ — a key indicator of AiTM cookie replay used by Scattered Spider and Storm-0539.
Data Sources
Required Tables
False Positives & Tuning
- Users on split-tunnel VPNs where IP changes between authenticated requests appear as new geographic locations
- Corporate mobility scenarios where employees roam between office Wi-Fi and cellular networks
- Automated service accounts or CI/CD pipelines authenticating from multiple cloud regions
- Cloud proxy or CASB solutions that rotate egress IPs transparently
- Users in border regions whose IP geolocation alternates between two country codes
Other platforms for THREAT-EntraID-TokenTheft
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Session Cookie Replay using Evilginx2 Captured Cookie
Expected signal: Azure AD Sign-in logs record a session established from the test IP without MFA, using the replayed cookie. Entra ID Identity Protection may generate an 'Unfamiliar sign-in properties' risk event.
Unlock Pro Content
Get the full detection package for THREAT-EntraID-TokenTheft including response playbook, investigation guide, and atomic red team tests.