Seeing Through the Fog: Interpreting Entra ID Signals During AiTM Attacks
summary
Shows a recorded demo where an adversary proxies Entra ID sign‑ins with an Evil Jinx variant, harvests session cookies, uploads them to Azure storage and drives a headless browser via Playwright automation to create MFA methods and inbox rules. Detectable signals include a consistent 15‑minute refresh pattern, mid‑session user‑agent shifts, token session IDs linked to backend Graph/Exchange activity, and conditional‑access alerts that auto‑close when users self‑remediate — mitigation: enforce phishing‑resistant MFA, restrict MFA enrollment, revoke sessions with CAE‑aware apps.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:59AiTM attack demo
- 13:46AiTM attacks rising despite MFA
- 20:30Entra ID false negatives
- 24:45Investigating sessions with KQL
- 35:26Key takeaways and mitigations
- 38:55Resources
related talks
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
26mTechnical Tracks
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
45mMFA: Stories that make you go 'Huh?'
40mModern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
09mThe dark art of OIDC abuse - A case study in Entra ID
31mLog In Through the Front Door: Automating Defense Against...
55mAzure Attacks Unpacked: Real-World Threats & Lessons