I assume it'd be the includes/session.php or whatever file is called when logging in.
If you look at my vbLoginLog hack you will see where you can catch each time the user logs in. Now the way I did it only works when the user actually has to login with username and password. It will detect if they use cookies to login.