Forg365 AiTM redirect with interaction_required error followed by M365 sign-in
Detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. The rule correlates browser network events where a user lands on a non-Microsoft host showing interaction required or session information errors, followed shortly by a successful Entra ID sign-in from the same user account.
Microsoft Sentinel (KQL)
