Recurring ~8-hour Outlook sign-ins with same SessionId across shifting ASN (residential proxy)
Detects Outlook sign-ins that reuse the same SessionId roughly every 8 hours while source IP/ASN change, consistent with attackers replaying a stolen AiTM-captured session token through rotating residential proxy infrastructure.
Microsoft Sentinel (KQL)
