M365 Session Cookie Replay Anomaly (AitM)
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
Sigma
