AiTM Token Theft Indicator: 50199 error code with Graph Resource Access

0xgrim- K@EsKay

•updated Aug 31, 2026•3•0•65

This alert triggers on a sign-in event with error code (50199) Login:Reprocess followed by or correlated with a graph api resource access event from the same user. This combination of event can be indicative of AiTM. As the associated blog suggests the current flow being login -> enumeration utilizing graph api. To increase the fidelity of the rule you can also add in |user_agent=/(OfficeHome)/ and feel free to pipe in additional suspicious user_agents.