Anomalous non-interactive token refresh cadence or new IP/device indicating stolen session tokens
Detects non-interactive token refreshes occurring at anomalously consistent short intervals or from previously unseen IPs/devices, consistent with AiTM stolen session token replay used to maintain persistent access.
Microsoft Sentinel (KQL)
