-
Entra ID Device Registration with Phishing Kit Default OS Build
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide Noise: Unknown Performance: Normal Threat: AiTM Phishing Rule Type: Custom Query (KQL) Platform: Entra ID ·Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher "10.0.19045.
" value.
Read More -
Entra ID Kali365 Default User-Agent Detected
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-In Logs Data Source: Microsoft Entra ID Audit Logs Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Threat: Kali365 Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: AiTM Phishing Rule Type: Custom Query (KQL) Platform: Entra ID Platform: Microsoft 365 Domain: SaaS Domain: Email ·Identifies the default user agent string associated with Kali365 (also referred to as Kali365 Live), a phishing-as-a-service (PhaaS) platform that automates OAuth 2.0 device code phishing and adversary-in-the-middle (AiTM) session capture against Microsoft 365 and Microsoft Entra ID. The Kali365 Electron desktop client identifies itself with the user agent
kali365-live/1.0.0when polling for and replaying captured OAuth tokens, so its appearance in Entra ID sign-in logs, Entra ID audit logs, or the Microsoft 365 unified audit log indicates that an attacker-controlled Kali365 client is interacting with the tenant using stolen tokens. Unlike dual-use offensive tooling, Kali365 is a criminal service with no legitimate enterprise use, making this user agent a high-fidelity indicator of active account compromise.
Read More -
Entra ID Phishing Kit Default OS Build (Entity Analytics)
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Entity Analytics Use Case: Asset Visibility Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide Noise: Unknown Performance: Fast Profile: Recommended Threat: AiTM Phishing Rule Type: New Terms Platform: Entra ID ·Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default "DESKTOP-" pattern and whose operating system build is "10.0.19045.2006". This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher "10.0.19045.
" value, so a device frozen at ".2006" with a default name is a high-fidelity, though evadable, indicator.
Read More