Threat Hunt: Potential ADFSjacking - Redirects in Microsoft Environments

Awais Munir@iawais

•updated Aug 25, 2025•5•5•142

This detection identifies suspicious use of wreply or redirect_uri parameters in ADFS or Microsoft login URLs. Attackers can abuse these parameters to redirect users to non-Microsoft domains after authentication, a technique commonly referred to as ADFSjacking.