mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Samirbous
be33bf0844
* [New] Potential AiTM UserLoggedIn via Office App
Detects Microsoft 365 audit `UserLoggedIn` events where the client application and object identifiers match a first-party Microsoft Office web client application ID and the user agent matches axios, an indicator associated with Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity. Tycoon 2FA is used to bypass MFA by relaying authentication and capturing session material, often targeting Microsoft 365 and Gmail. This combination is uncommon
for legitimate browser-based user sessions and should be validated against approved automation.
* Update rules/integrations/azure/initial_access_entra_id_tycoon_2fa_officehome_axios_user_agent.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/integrations/azure/initial_access_entra_id_tycoon_2fa_officehome_axios_user_agent.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/integrations/o365/initial_access_identity_tycoon_2fa_user_logged_in_office_app_axios_user_agent.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/integrations/o365/initial_access_identity_tycoon_2fa_user_logged_in_office_app_axios_user_agent.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Update rules/integrations/o365/initial_access_identity_tycoon_2fa_user_logged_in_office_app_axios_user_agent.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* Apply suggestion from @terrancedejesus
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
* ++
* ++
* Rename initial_access_tycoon_azure.toml to initial_access_tycoon_entra_id.toml
* Update rules/integrations/o365/initial_access_tycoon_o365.toml
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
---------
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
(cherry picked from commit e4eb3702df)