Phishing Link Click Followed By High-Risk Authentication

Correlates user interaction with email URLs and subsequent risky sign-ins occurring shortly afterward. Commonly observed in adversary-in-the-middle (AiTM) campaigns.

Microsoft Sentinel (KQL)