AiTM reverse-proxy relaying Microsoft 365 auth flow captures session cookie
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
Sigma
