Anomalous non-interactive token issuance after interactive sign-in AiTM pattern — Solutions Analyzer

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Identifies non-interactive sign-ins from a different IP and autonomous system than the preceding interactive sign-in for the same user within a 10-minute window, consistent with AiTM phishing token replay.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	`2a2c676e-885f-43d9-90cb-2c035772e31c`
Tactics	InitialAccess, CredentialAccess
Techniques	T1539, T1550
Required Connectors	AzureActiveDirectory
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/AnomalousTokenIssuanceAfterAiTM.yaml)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries