Google Workspace 2FA Completion < 1s
Identifies login_verification events completing in less than 1 second, strongly indicative of automated AiTM proxying.
Microsoft Sentinel (KQL)

Identifies login_verification events completing in less than 1 second, strongly indicative of automated AiTM proxying.

Already have an account?