Cross-Tenant Guest Invite Shortly After AiTM/Risky Sign-in

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

This rule detects a correlation between high-risk or anomaly-flagged sign-ins and subsequent changes to B2B guest invitation or tenant collaboration policies by the same user account within a 30-minute window. This behavior is indicative of an adversary who has successfully hijacked a session (e.g., via AiTM or token replay) and is attempting to establish persistence or pivot by inviting external accounts or modifying B2B security settings.