SOHO Hijack - AiTM via DNS Hijack HTTP POST (T1566)
Correlates the successful DNS resolution of a legit domain to a malicious IP, followed by an HTTP POST submitting stolen credentials. Specifically looks for POST requests to 'login.microsoftonline.com' where the remote IP address is not a known Microsoft IP range (13.x.x.x or 20.x.x.x).
Microsoft Sentinel (KQL)
