Bluekit PhaaS AitM/BitM Proxy Sign-in from Hosting Provider IP with Anomalous Session
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
Microsoft Sentinel (KQL)
