Azure AD Sign-In: Token Reuse Without Fresh MFA Claim

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•3

Detects Azure AD/Entra ID authentication events where a session token or cookie is used without performing a fresh interactive MFA challenge, which is characteristic of session hijacking or adversary-in-the-middle (AiTM) relay attacks (e.g., NovaCookies) used to bypass security controls after initial authentication.