AiTM Sign-In Pattern: Error 50074 Followed by 50140

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

This rule detects a suspicious Azure sign-in sequence, identified by error code 50074 (User failed MFA) followed by 50140 (This error occurred due to 'Keep me signed in' interrupt when the user was authenticating). This pattern is indicative of an Adversary-in-the-Middle (AiTM) phishing attack where the attacker is attempting to bypass MFA or manipulate session persistence after capturing initial credentials.