AiTM M365 Session Token Replay - IP Change on Non-Interactive Sign-in
Detects non-interactive OAuth2 token refresh attempts targeting Microsoft 365 services where the authentication is satisfied by a pre-existing session without MFA challenge. The rule flags instances where the sign-in originates from an IP address with a different ASN or country than the user's previous interactive session and uses specific browser user-agents identified in known Adversary-in-the-Middle (AiTM) campaigns like the Payroll Pirate.
Sigma
