Kali365 / EvilTokens - BAV2ROPC Automated Refresh from Railway

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•9

Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.