AiTM Phishing: Fake Google/Gmail Login Page via Non-Google IP
Detects browser-based network connections to URLs containing Google or Gmail branding where the resolved IP address does not match the expected Google IP address prefixes. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack, where a user is being redirected to a malicious proxy server that mimics the legitimate Google login service to intercept credentials and MFA tokens.
Microsoft Sentinel (KQL)
