AiTM Sign-In: Error 50074 then 50140 from Unmanaged Device

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects a suspicious sign-in sequence indicative of an Adversary-in-the-Middle (AiTM) phishing attack. The rule identifies a user attempting to sign in from an unmanaged device (triggered by Azure AD error 50074, requiring secondary authentication) followed shortly by an interruption in session persistence (triggered by error 50140) while using a browser user agent, suggesting the session is being relayed through a malicious proxy.