Fake M365 login page with generic "Authentication" title tag
This rule monitors network response bodies for the presence of a specific HTML title indicating an authentication page. This can be used to identify potential entry points for brute force or credential harvesting attacks against exposed authentication interfaces.
Microsoft Sentinel (KQL)
