Check, anywhere during a session, if a logged in user has previously logged in
A cookie would work. Another way is to add a field to the user entity that you can check that field first to see if it's empty, and then modify it with a Rule, triggered by the log in action