aitm-high-confidence-detection.kql

Sagar Patel@sagar

•updated May 12, 2026•44•0•618

Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes