Kali365 / EvilTokens - Sign-in from Railway.com IPs (General)
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Microsoft Sentinel (KQL)
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Already have an account?