Impossible Travel Logins: Potential Adversary-in-the-Middle Activity - O365
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle). Error Code 0 Successful authentication Normal successful login (validate carefully only when paired with suspicious failures) Error Code 50053 Account locked or malicious IP HIGH - Brute force attempts Error Code 50074 MFA challenge not passed HIGH - User failed MFA Error Code 500121 MFA prompt timeout MEDIUM - Possible MFA fatigue indicator Error Code 50133 Session revoked or SSO artifact invalid HIGH - Session hijacking indicator Error Code 50076 MFA required but not provided MEDIUM - Possible MFA bypass attempt
Splunk (SPL)
