General

Attic uses several detection rules to flag sign-in attempts in the Sign-in logs that match patterns commonly associated with cybercriminal behavior.

• RULE-1151 – IP address belongs to a cloud provider
• RULE-1154 – Match with threat intel in Attic’s Threat Intelligence database
• RULE-1155 – Empty user agent
• RULE-1156 – Pattern matches in user agents

Rationale

Sign-in attempts with suspicious characteristics are strong indicators of cybercriminal activity, especially in adversary-in-the-middle (AiTM) attacks.

During an AiTM attack, the phishing kit attempts to log in to your accounts to capture passwords and cookies. These automated tools often exhibit specific patterns that differ from legitimate user behavior — such as rapid repeated attempts, unusual timing patterns, or specific request signatures commonly associated with credential harvesting and session hijacking.

Follow-up

Follow these steps to respond appropriately to this detection:

1. Navigate to Microsoft Entra ID: https://entra.microsoft.com
2. Temporarily block the account
3. Revoke all active user sessions
4. Investigate the authentication methods to see if a new one was added
5. Check for any newly registered applications
6. Review other suspicious activity by the account since the login attempt, using the Unified Audit Log: https://security.microsoft.com/auditlogsearch
7. Before unblocking the account: change the account's password

If you need help with these steps, the Attic IR team can carry them out for you. You will need an IR Credit Pack for this.

More information

1. Microsoft Identity Protection
2. Authentication Strengths