Potential AiTM Activity from Multiple User IP Addresses
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Microsoft Sentinel (KQL)
