T1557: AitM MFA Approval from Unmanaged Device on Teams/Slack Sign-In
Detects successful authentication to Microsoft Teams or Slack where MFA was successfully completed, but the device is reported as unmanaged or non-compliant and is accompanied by sign-in risk signals. This behavior is consistent with Adversary-in-the-Middle (AitM) proxy attacks where an attacker captures credentials and session tokens, bypassing MFA, and using the hijacked session from an unrecognized device or location.
Microsoft Sentinel (KQL)
