-
Entra ID Device Registration with Phishing Kit Default OS Build
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Audit Logs Use Case: Identity and Access Audit Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide Noise: Unknown Performance: Normal Threat: AiTM Phishing Rule Type: Custom Query (KQL) Platform: Entra ID ·Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and it is uncommon for the OS build to match this exact value across an environment of otherwise patched hosts, where a current Windows 10 22H2 device reports a far higher "10.0.19045.
" value.
Read More -
Entra ID OAuth Device Code Phishing via AiTM
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-In Logs Use Case: Threat Detection Threat: Tycoon2FA Tactic: Initial Access Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Device Code Phishing Rule Type: Custom Query (KQL) Platform: Entra ID ·Detects successful Microsoft Entra ID sign-ins that use the OAuth device code authentication protocol with the Microsoft Authentication Broker client requesting first-party Office API resources (Exchange Online, Microsoft Graph, or SharePoint) while flagged as interactive. This pattern is associated with adversary-in-the-middle (AiTM) phishing kits such as Tycoon 2FA, where victims complete device code flows that ultimately broker tokens for mail and collaboration APIs.
Read More -
Entra ID Phishing Kit Default OS Build (Entity Analytics)
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Entity Analytics Use Case: Asset Visibility Use Case: Threat Detection Threat: Tycoon2FA Threat: Kali365 Tactic: Persistence Resources: Investigation Guide Noise: Unknown Performance: Fast Profile: Recommended Threat: AiTM Phishing Rule Type: New Terms Platform: Entra ID ·Identifies the first occurrence of a Microsoft Entra ID device, surfaced through the Entra ID Entity Analytics device inventory, whose host name follows the default "DESKTOP-" pattern and whose operating system build is "10.0.19045.2006". This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence. The build is hardcoded by the tooling and differs from legitimate hosts: a patched Windows 10 22H2 device reports a far higher "10.0.19045.
" value, so a device frozen at ".2006" with a default name is a high-fidelity, though evadable, indicator.
Read More -
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-In Logs Use Case: Threat Detection Threat: Tycoon2FA Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Threat: AiTM Phishing Rule Type: Custom Query (KQL) Platform: Entra ID ·Detects Microsoft Entra ID sign-ins consistent with Tycoon2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity: the Microsoft Authentication Broker requesting tokens for Microsoft Graph or Exchange Online, or the Office web client application authenticating to itself, combined with Node.js-style user agents (node, axios, undici). Tycoon 2FA bypasses MFA by relaying authentication and capturing session material, often targeting Microsoft 365 and Gmail. Baseline legitimate automation and developer tooling before tuning.
Read More -
Google Workspace Device Registration After OAuth from Suspicious ASN
Sep 19, 2026 · Domain: Cloud Data Source: Google Workspace Data Source: Google Workspace Audit Logs Use Case: Threat Detection Tactic: Persistence Tactic: Initial Access Threat: Tycoon2FA Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Rule Type: Event Correlation (EQL) Platform: Google Workspace Domain: SaaS ·Detects when a Google Workspace account completes OAuth authorization for a specific Google OAuth client from a high-risk autonomous system number (ASN), followed within 30 seconds by a device registration event with account state REGISTERED. This sequence can indicate device enrollment or join flows initiated from attacker-controlled or residential-proxy infrastructure after a user authorizes a sensitive client.
Read More -
M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)
Sep 19, 2026 · Domain: Cloud Domain: Identity Domain: SaaS Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Threat: Tycoon2FA Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: Unknown Performance: Normal Profile: Recommended Threat: AiTM Phishing Rule Type: Custom Query (KQL) Platform: Microsoft 365 Domain: Email ·Detects Microsoft 365 audit "UserLoggedIn" events consistent with Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity: the Microsoft Authentication Broker requesting access where the object identifier matches Microsoft Graph or Exchange Online, or the Office web client application authenticating to itself, combined with Node.js-style user agents (node, axios, undici). Tycoon 2FA bypasses MFA by relaying authentication and capturing session material, often targeting Microsoft 365 and Gmail. Baseline legitimate automation and developer tooling before tuning.
Read More