AiTM Proxy Relays Authorisation Requests and Session Cookies

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•5

Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.