PhaaS AiTM Microsoft Lookalike Domain Activity – Sneaky2FA/Tycoon/EvilProxy
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Microsoft Sentinel (KQL)
