Non-interactive Entra sign-in with automated HTTP client user-agent (AiTM token

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects non-interactive sign-in events to common Microsoft 365 applications (OfficeHome, Outlook, My Sign-Ins, My Profile) where the User-Agent identifies as an automated HTTP client library (Axios or Python-requests). This behavior is often indicative of programmatic access via stolen session cookies or application tokens, commonly seen in adversary activity such as payroll-related business email compromise.