Tycoon/ODx 2FA Phishing Kit

Aamir Muhammad@Aamir

•updated Aug 17, 2025•20•2•209

This rule detects Tycoon and ODx AiTM phishing activity that bypasses MFA. It matches: 🔹 Network connections to known malicious domains, IP addresses, and URLs. 🔹 Email-URL clicks and Azure AD sign-in events involving those domains or specific malicious application IDs. 🔹 Sign-ins originating from suspect IP addresses or user-agent strings.