Phishing Series 2026: MFA-Satisfied Sign-In From Never-Seen ASN Minutes After Phishing Link Click
This rule correlates phishing emails containing URLs with successful, MFA-satisfied sign-ins from an ASN or network location that has not been associated with the user account within the previous 30 days. This pattern is highly indicative of an Adversary-in-the-Middle (AiTM) session hijacking attempt, where a user is phished and their session cookie is intercepted by an attacker.
Microsoft Sentinel (KQL)
