Payroll Pirate AiTM - M365 Sign-in from Residential Proxy ASN or Impossible Travel
Detects Microsoft 365 sign-in activity consistent with the Payroll Pirate campaign. This rule monitors for successful sign-ins originating from known residential proxy ASN providers (IPRoyal, Bright Data, Oxylabs) or instances where a successful sign-in occurs with a suspicious browser fingerprint (Firefox 131.0/142.0) during a Microsoft Graph OAuth2 token request, indicating session-token replay.
Sigma
