Tycoon2FA PHaaS User Agent Detection
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Splunk (SPL)
