Non-interactive Entra sign-in with Axios user-agent (AiTM token replay)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

This rule detects non-interactive sign-in events to common Microsoft services (e.g., OfficeHome, Outlook) where the User-Agent string contains 'axios/1.7.9'. This pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing kits that use the Axios library to automate token replay attacks by simulating browser sign-in requests.