What this alert means
A session token replay attack occurs when an attacker steals a user's active session token — typically by intercepting browser cookies or through a session hijacking technique — and uses it to authenticate as that user without needing their password or MFA code. Because the attacker presents a valid, unexpired session token, this attack can bypass multi-factor authentication entirely.
Guardz detected that a valid session token for a user account was used from an unexpected location or IP address consistent with known session replay behavior. The attacker may currently have active access to the account.
Step 1: Immediately revoke sessions
The fastest way to cut off attacker access is to revoke all active session tokens for the affected user. Guardz provides a one-click action for this:
Go to the Incidents screen in the Guardz portal.
Locate the session token replay alert.
Open the Action Center and select Revoke Sessions.
Revoke Sessions immediately invalidates all active session tokens, logging the user out of all devices and forcing re-authentication. The attacker's access is terminated without permanently disabling the user's account.
Microsoft 365: Full session revocation may take up to one hour due to Microsoft's token refresh architecture. This is expected — the action is in progress even if the attacker's access isn't cut off immediately.
By default, Guardz MDR analysts are pre-approved to take this action on your behalf. If you prefer to require approval first, change this under Security Controls → MDR → MDR Services Configuration.
Step 2: Complete account remediation
After revoking sessions, complete the steps below for the affected user's platform. These close remaining attack vectors and secure the account before re-enabling user access.
For Microsoft 365:
Suspend the affected user account immediately to block all access while remediation is in progress.
Force a password reset with a secure, randomly generated password for the affected user.
Force an MFA reset and revoke the existing MFA session for the user.
Force logoff all active sessions and revoke all refresh tokens.
Review OAuth application permissions granted to the affected account and revoke any suspicious or unrecognized applications.
Notify the user and relevant stakeholders of the incident and next steps.
Re-enable the user account only after the password reset and MFA re-enrollment are confirmed complete.
For Google Workspace:
Suspend the affected user account immediately to block all access while remediation is in progress.
Force a password reset with a secure, randomly generated password.
Reset the user's sign-in cookies to terminate all remaining active sessions.
Review OAuth applications that have access to the account and revoke any suspicious or unrecognized applications.
Verify that 2-Step Verification is enabled. If backup codes may have been compromised, regenerate them.
Review IP access patterns and authentication logs to determine when and from where the account was accessed.
Notify the user and relevant stakeholders of the incident and next steps.
Re-enable the user account only after the password reset and 2-Step Verification settings are verified.
Step 3: Check for further compromise
Session token replay attacks frequently target email accounts. Before closing the incident, check the following:
Review the user's mailbox for unauthorized sent items, deleted messages, or forwarding rules that were added during the attack window.
Check whether sensitive files, documents, or admin settings were accessed or modified.
Confirm no other accounts in the same organization show signs of access from the same stolen session token or attacker IP.
Prevent recurrence
Add known IPs to Approved Locations
If your users regularly authenticate from specific, known IP ranges — such as an office network or a fixed VPN — add those IPs to Approved Locations in Guardz. This lets Guardz flag logins from unexpected locations more aggressively and reduces noise from legitimate access patterns.
Limit session lifetimes
Session token replay attacks rely on stolen tokens that remain valid for extended periods. Reducing session lifetimes and requiring periodic re-authentication shrinks the window an attacker has to exploit a captured token. Review your Microsoft 365 Conditional Access policies or Google Workspace session control settings to enforce appropriate session durations.
Audit MFA enrollment across all users
Accounts without MFA — or where MFA can be bypassed through session theft — are the primary targets for replay attacks. Ensure MFA is enforced for all users in the affected organization, and periodically audit enrollment to confirm no accounts have been excluded or exempted.
When to contact Guardz Support
Revoke Sessions is unavailable in the Action Center or does not complete successfully.
You cannot complete the remediation steps above without backend access or additional platform assistance.
The same user account triggers another session token replay alert after remediation is complete.
You need Guardz to coordinate with Microsoft or Google on your behalf.