Endpoint DNS resolution to mysignins.microsoft.com security portal

Ibrahim Saud@tektrix

•updated 22 days ago•2•0•6

Detects endpoint DNS resolution for the 'mysignins.microsoft.com' domain. This domain is frequently used in Adversary-in-the-Middle (AiTM) phishing attacks to facilitate user interaction with legitimate Microsoft portals while the attacker intercepts session tokens.