Listen to this Post
Introduction:
The Monday morning coffee ritual was brutally interrupted when a custom identity monitoring pipeline flagged a high-severity session anomaly from the weekend. Within minutes, the incident was validated, all active sessions were revoked, corporate credentials and MFA were reset, and VPN access was severed—completely containing the breach before the work week even gained momentum. The attack wasn’t malware; it was an Adversary-in-the-Middle (AiTM) token theft where a sophisticated phishing page hijacked an active session token, leaving traditional antivirus blind and proving that identity is the modern perimeter.
Learning Objectives:
- Understand the technical mechanics of Adversary-in-the-Middle (AiTM) token theft and why it bypasses traditional MFA protections.
- Learn how to detect session anomalies using identity timelines, browser fingerprints, and network context.
- Master the first-hour containment workflow, including token revocation, credential resets, and persistence hunting.
- Implement proactive defenses like device-bound Conditional Access, linkable token identifiers, and phishing-resistant MFA.
- Apply practical Linux/Windows commands and KQL queries to hunt for and mitigate token replay attacks.
- Understanding AiTM Token Theft: The Attack That Doesn’t Break Authentication
An AiTM phishing site is not a basic replica of a login page—it is a live reverse proxy. The attacker’s infrastructure sits between the user and the real authentication service, relaying every keystroke, redirect, and server response in real time. From the user’s perspective, nothing looks wrong: the page behaves exactly like the real service, with correct branding, working redirects, and a functioning MFA prompt.
What gets stolen is not just the password but the authenticated session itself—session cookies, access tokens, and refresh tokens that allow the attacker to silently mint new access tokens after the initial session expires. Because the login was genuine and MFA was successfully completed, the identity provider trusts the token and grants access without additional challenges. This is why AiTM breaks standard phishing detection: there are no failed login attempts, no repeated MFA denials, and no brute-force noise.
Popular AiTM Frameworks:
- Evilginx2 – Open-source man-in-the-middle proxy that captures credentials and session tokens
- Modlishka – Reverse proxy with universal 2FA bypass support
- Tycoon 2FA – Turnkey AiTM kit targeting Microsoft 365 and Google Workspace
- Mirage – AiTM reverse proxy framework for authorized red team engagements
- Detection: Hunting for the Needle in the Authentication Haystack
Detecting AiTM attacks requires shifting from event-based to state-based SIEM logic. The core detection pattern is the “Impossible Session Token Travel”—identifying when the same active session is used from two or more distinct IP address-user agent pairs.
Key Detection Indicators:
- Session Concurrency – Two sessions for the same user, close in time, with different fingerprints
- Geographic Anomalies – Authentication attempts from locations inconsistent with user travel patterns
- Token Churn – Unusual refresh token activity or sudden spikes in token refresh attempts
- IP Deviation – Same identity authenticating successfully from more than one IP within a 10-minute window
- Device Registration Bursts – Multiple device attestations from the same infrastructure within seconds
Microsoft Sentinel / Defender XDR KQL Query for Token Theft Detection:
// Detect potential token replay - same user, multiple IPs in short window AadSignInEventsBeta | where Timestamp > ago(1h) | summarize SignInCount = count(), IPs = make_set(IPAddress), Locations = make_set(Country) by UserPrincipalName, SessionId | where array_length(IPs) > 1 | project UserPrincipalName, SessionId, IPs, Locations, SignInCount
PowerShell: Quick Session Revocation for Suspected Compromise
Revoke all sessions for a specific user in Microsoft Entra ID Revoke-AzureADUserAllRefreshToken -ObjectId "[email protected]" Force MFA re-registration $user = Get-AzureADUser -ObjectId "[email protected]" $user | Set-AzureADUser -StrongAuthenticationRequirements @()
3. First-Hour Containment: The Incident Response Playbook
When an AiTM attack is suspected, speed is everything. The first hour determines whether the breach remains contained or escalates into full account takeover.
Step-by-Step Containment Workflow:
1. Validate the Alert (10-15 minutes)
- Check timeline integrity: Does the MFA approval time and session creation time make sense for the same user, device, and network?
- Verify session concurrency: Are there multiple active sessions with different fingerprints?
2. Revoke All Active Sessions
- Microsoft Entra ID: Use the Azure portal or PowerShell to revoke all refresh tokens
- Force the user to re-authenticate and re-register MFA
3. Reset Corporate Credentials
- Force password change (even though password wasn’t stolen, it’s a hygiene measure)
- Reset all MFA methods and require phishing-resistant MFA (FIDO2/passkeys) going forward
4. Sever Network Access
- Revoke VPN access and any persistent network connections
- Block the attacker’s source IP at the network perimeter
5. Hunt for Persistence
- Check for new mailbox rules (auto-forwarding, deletions)
- Audit for new OAuth app consent grants or IAM role modifications
- Investigate any newly created administrative accounts or privilege escalations
Microsoft Entra ID Incident Response with Safeguard Tool:
Install Safeguard - Entra ID Incident Response Tool git clone https://github.com/AlchemicalChef/Safeguard.git Revoke all tokens and reset MFA for compromised user .\Safeguard.ps1 -RevokeUser -UserPrincipalName "[email protected]" -ResetMFA
4. Prevention: Building the Identity-Centric Defense
The most effective defense against AiTM is preventing token theft in the first place.
Control 1: Phishing-Resistant MFA
FIDO2 and passkeys bind the authentication challenge cryptographically to the legitimate domain, so a proxy domain cannot complete the handshake. Organizations that have deployed passkeys broadly have significantly reduced their AiTM exposure at the authentication layer.
Control 2: Device-Bound Conditional Access
Require managed, compliant devices as a condition of accessing sensitive resources. An attacker who intercepts a session token cannot easily replay it from an unmanaged machine if the policy requires device compliance.
Control 3: Linkable Token Identifiers
Microsoft Entra ID embeds unique token identifiers (UTI) in every access token, enabling correlation of activities back to a single root authentication event. These linkable identifiers appear in customer-facing logs, helping threat hunters track and investigate identity-based attacks across sessions and tokens.
Control 4: Continuous Access Evaluation (CAE)
Universal CAE revokes and revalidates network access in near real-time whenever Entra ID detects changes to the identity. Enable Strict Enforcement mode in Conditional Access to protect from token theft and replay.
Entra ID Conditional Access Policy (PowerShell):
Require compliant device for all cloud app access
New-AzureADMSConditionalAccessPolicy -1ame "Require Compliant Device" `
-State "enabled" `
-Conditions @{Applications = @{IncludeApplications = "All"}} `
-GrantControls @{BuiltInControls = "RequireCompliantDevice"}
- Linux/Windows Commands for Token Theft Investigation and Response
Linux Commands for Forensic Analysis:
Check for suspicious network connections (potential C2 or proxy traffic)
ss -tunap | grep ESTABLISHED
netstat -tulpn | grep LISTEN
Analyze system logs for unusual authentication patterns
journalctl -u sshd --since "1 hour ago" | grep "Failed password"
grep "Accepted" /var/log/auth.log | awk '{print $1,$2,$3,$9,$11}'
Check for recently modified files (potential persistence)
find /etc -mmin -60 -type f 2>/dev/null
find /tmp -mmin -30 -type f -exec ls -la {} \; 2>/dev/null
Monitor active user sessions and kill suspicious ones
who -a
pkill -KILL -u suspicious_username
Windows Commands (PowerShell) for Incident Response:
List all active user sessions
query user
Force logout of a specific session
logoff <session_id>
Check for suspicious scheduled tasks (persistence)
Get-ScheduledTask | Where-Object {$_.State -eq "Running"}
Audit recent account changes
Get-EventLog -LogName Security -InstanceId 4728,4729,4732,4733 -1ewest 50
Check for suspicious network connections
Get-1etTCPConnection | Where-Object {$_.State -eq "Established"}
Revoke all Kerberos tickets (Windows domain environment)
klist -li 0x3e7 purge
6. Advanced Detection: Building State-Based SIEM Logic
Traditional SIEM logic focuses on individual events, but AiTM attacks require state-based correlation.
Detection Pattern: Impossible Session Token Travel
// KQL query for Microsoft Sentinel
AadSignInEventsBeta
| where Timestamp > ago(24h)
| project UserPrincipalName, IPAddress, City, State, Country, SessionId, Timestamp
| sort by UserPrincipalName asc, Timestamp asc
| extend NextIP = next(IPAddress, 1), NextCity = next(City, 1), NextTime = next(Timestamp, 1)
| where IPAddress != NextIP and City != NextCity
| project UserPrincipalName, IPAddress, City, Timestamp, NextIP, NextCity, NextTime
| extend TimeDifference = datetime_diff('minute', NextTime, Timestamp)
| where TimeDifference < 15
Detection Pattern: OAuth Token Replay Anomaly
// Detect multiple device attestations from same infrastructure CloudAppEvents | where Timestamp > ago(1h) | where Application == "Microsoft 365" | where ActionType == "DeviceRegistration" | summarize Devices = make_set(DeviceName), IPs = make_set(IPAddress) by UserPrincipalName | where array_length(Devices) > 1
- The Human Element: Why Speed and Honesty Matter
During the incident described in the original post, the user’s transparent and immediate communication during the cleanup was critical. Speed and honesty are everything when responding to a breach—delaying reporting or attempting to hide the incident only gives the attacker more time to escalate privileges and exfiltrate data.
Organizations should foster a culture where users feel safe reporting suspicious activity without fear of blame. This psychological safety directly impacts mean time to detect (MTTD) and mean time to respond (MTTR).
What Undercode Say:
- Key Takeaway 1: Traditional antivirus and endpoint protection are blind to AiTM token theft because the user technically completes the authentication process. Security teams must shift their focus from endpoint-centric to identity-centric monitoring.
-
Key Takeaway 2: Alert payloads must be context-rich and dynamically build direct deep links to target logs. This eliminates portal hunting and reduces triage time from hours to minutes—the difference between containment and a full-blown breach.
Analysis: The incident described is a textbook example of why identity has become the new perimeter. The attacker didn’t break in—they walked in using a valid session token. The response was effective because the detection pipeline was engineered for speed: custom alerts with direct log links, immediate session revocation, and credential resets. However, the root cause—the user falling for a sophisticated phishing page—remains a human vulnerability that no technology can fully eliminate. Organizations must combine phishing-resistant MFA (FIDO2/passkeys), device-bound Conditional Access, and continuous user security awareness training to close the gap. The attacker’s ability to bypass MFA entirely using a reverse proxy demonstrates that MFA alone is no longer sufficient—session security must be treated with the same rigor as authentication security.
Prediction:
- +1 The adoption of phishing-resistant MFA (FIDO2/passkeys) will accelerate dramatically, with major cloud providers mandating it for privileged accounts within 18-24 months.
-
+1 AI-driven behavioral analytics will become the primary detection mechanism for token replay attacks, moving beyond static rules to real-time user behavior profiling.
-
-1 AiTM-as-a-Service platforms will continue to professionalize, lowering the barrier to entry for low-skilled attackers and increasing the volume of token theft incidents.
-
-1 Organizations that fail to implement device-bound Conditional Access will experience token replay breaches at exponentially higher rates as attackers scale their operations.
-
+1 Microsoft Entra ID’s linkable token identifiers and Continuous Access Evaluation will become industry standards, forcing other identity providers to implement similar token-binding mechanisms.
-
-1 The shift to identity-centric security will create a skills gap, with demand for identity security specialists far outpacing supply for the next 3-5 years.
-
+1 Security teams will increasingly adopt “assume breach” mentality, treating every successful authentication as potentially compromised and implementing Zero Trust principles at the session level.
-
-1 Business Email Compromise (BEC) campaigns leveraging AiTM techniques will become more sophisticated, using stolen tokens to not only access mailboxes but also manipulate financial systems and HR platforms.
▶️ Related Video (76% Match):
https://www.youtube.com/watch?v=2TqgIy0XCd0
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Victor Au – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
