mitmproxy/mitmweb reverse-proxy TLS interception of login.microsoftonline.com
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
Microsoft Sentinel (KQL)
