Payroll Pirate: HR Direct Deposit or Bank Account Change After Suspicious M365 Sign-In

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects unauthorized changes to sensitive payroll information (such as bank accounts or direct deposit details) or suspicious inbox rule creations within Microsoft 365 or HR SaaS environments that occur immediately following anomalous authentication activity. The rule targets indicators of AiTM (Adversary-in-the-Middle) session hijacking, such as unusual user agents, unmanaged device usage, or potential token reuse.