Kali365 Phishing Kit Weaponizes Microsoft Authentication: AiTM Detection and Defense Guide for Microsoft 365

---
title: Suspicious OAuth Consent Grant Following Anomalous Sign-In
id: 3f8a1b42-7c9d-4e51-a2b6-9d4e5f6a7b8c
status: experimental
description: Detects new OAuth application consent grants in Entra ID, a common persistence mechanism after AiTM session token theft. Correlate with sign-in anomalies and alert on grants to unverified publishers or broad mail/Graph scopes.
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1557/002/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.credential_access
  - attack.t1557.002
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - 'Consent to application'
      - 'Add service principal'
      - 'Add app role assignment to service principal'
  filter_verified:
    # Reduce noise from well-known verified first-party/enterprise apps
    properties.TargetResources|contains: 'verified'
  condition: selection and not filter_verified
falsepositives:
  - Legitimate line-of-business app onboarding (maintain an allowlist of approved app display names)
  - Admin-initiated enterprise application registrations
level: high
---
title: Malicious Inbox Rule Creation for Email Concealment
id: 6e2d9c14-4a7f-4b83-91d5-2c8e3f5a6b7d
status: experimental
description: Detects Exchange Online inbox rule creation that hides or deletes messages, a hallmark of business email compromise and post-AiTM mailbox access. Rules moving messages to RSS/Archive/Junk or auto-deleting replies are frequently used to conceal attacker conversations from the victim.
references:
  - https://attack.mitre.org/techniques/T1098/002/
  - https://attack.mitre.org/techniques/T1557/002/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1098.002
logsource:
  product: azure
  service: exchange
detection:
  selection:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  suspicious_params:
    Parameters|contains:
      - 'DeleteMessage'
      - 'RSS Subscriptions'
      - 'Conversation History'
      - 'MoveToFolder'
  condition: selection and suspicious_params
falsepositives:
  - User-created organizational rules (tune by excluding known benign folder targets in your tenant)
level: medium
---
title: Browser-Spawning Script Interpreter After Phishing Link Click
id: 9c4e7a21-5d3b-48f2-b6a1-8e7d2c4f5a6b
status: experimental
description: Detects script interpreters (PowerShell, mshta, rundll32) spawned by a browser process, consistent with post-click phishing payload execution observed in some AiTM delivery chains (HTML smuggling, fake update lures). High-signal when combined with identity-layer detections.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare browser extension or enterprise web-app integrations (baseline first)
level: high

// Hunt: AiTM session token theft indicators — anomalous token replay and auth-method abuse
// Sentinel tables: SigninLogs, AADNonInteractiveUserSignInLogs, AuditLogs, OfficeActivity
// 1) Sign-ins where a session is reused from a new IP/ASN without fresh MFA,
//    followed by mailbox or OAuth activity within a short window
let lookback = 14d;
let suspicious_signins =
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| summarize arg_min(TimeGenerated, *) by UserPrincipalName, SessionId, IPAddress
| extend AuthMethods = tostring(AuthenticationDetails)
| project SignInTime=TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, UserAgent, SessionId, AuthMethods, AuthenticationRequirement;
// 2) Join to OAuth consent grants shortly after (persistence stage)
let consent_events =
AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName has_any ("Consent to application", "Add service principal")
| extend InitiatedByUPN = tostring(InitiatedBy.user.userPrincipalName)
| extend TargetApp = tostring(TargetResources[0].displayName)
| project ConsentTime=TimeGenerated, InitiatedByUPN, TargetApp, OperationName;
suspicious_signins
| join kind=inner consent_events on $left.UserPrincipalName == $right.InitiatedByUPN
| where ConsentTime between (SignInTime .. SignInTime + 4h)
| project UserPrincipalName, SignInTime, IPAddress, Location, AppDisplayName, UserAgent, ConsentTime, TargetApp, OperationName
| order by SignInTime desc;
// 3) Standalone hunt: sign-ins from data-center/hosting ASNs or anonymizers against interactive apps
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where AppDisplayName has_any ("Office 365", "Microsoft Office", "SharePoint", "Exchange")
| extend NetworkDetails = tostring(NetworkLocationDetails)
| where NetworkDetails has_any ("hosting", "datacenter", "vpn", "proxy") or LocationDetails has "anonymous"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, UserAgent, NetworkDetails
| order by TimeGenerated desc

-- Hunt for browser-spawned script interpreters consistent with phishing payload execution
-- Deploy across endpoints via Velociraptor hunt; enrich hits with sign-in telemetry in Sentinel
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       parent().Name AS ParentName, parent().Exe AS ParentExe, parent().CommandLine AS ParentCmd
FROM pslist()
WHERE (Name =~ '(?i)powershell|pwsh|mshta|rundll32|wscript|cscript')
  AND (parent().Name =~ '(?i)msedge|chrome|firefox|brave|outlook|teams')
ORDER BY CreateTime DESC

# Kali365 / AiTM Phishing Response & Hardening Script (Microsoft 365 / Entra ID)
# Requires: Microsoft.Graph PowerShell SDK with scopes:
#   AuditLog.Read.All, Directory.Read.All, Policy.ReadWrite.ConditionalAccess,
#   Application.Read.All, UserAuthenticationMethod.Read.All
# Run as a Global Admin / Cloud App Admin during investigation or scheduled audit.

Import-Module Microsoft.Graph.Identity.SignIns
Import-Module Microsoft.Graph.Identity.DirectoryManagement
Import-Module Microsoft.Graph.Applications
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","Policy.ReadWrite.ConditionalAccess","Application.Read.All" -NoWelcome

# ---- 1. AUDIT: Find OAuth consent grants from the last 14 days (persistence check) ----
$since = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")
$consents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -in @("Consent to application","Add service principal") }
$consents | Select-Object ActivityDateTime,
    @{N='InitiatedBy';E={$_.InitiatedBy.User.UserPrincipalName}},
    ActivityDisplayName,
    @{N='TargetApp';E={$_.TargetResources[0].DisplayName}} |
    Format-Table -AutoSize
Write-Host "[+] Review each consent above. Unknown/unverified publisher apps should be investigated and revoked." -ForegroundColor Yellow

# ---- 2. AUDIT: OAuth grants with high-risk Graph scopes (mail/offline access) ----
$riskyScopes = @("Mail.Read","Mail.ReadWrite","Mail.Send","Files.ReadWrite.All","offline_access","full_access_as_app")
$grants = Get-MgOauth2PermissionGrant -All
foreach ($g in $grants) {
    $matched = $riskyScopes | Where-Object { $g.Scope -match [regex]::Escape($_) }
    if ($matched) {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
        Write-Host "[!] RISKY GRANT: $($sp.DisplayName) ($($g.ClientId)) scopes: $($g.Scope)" -ForegroundColor Red
    }
}

# ---- 3. RESPONSE: Revoke refresh tokens for a compromised user ----
# Usage: Revoke-UserSessions -Upn "victim@company.com"
function Revoke-UserSessions {
    param([Parameter(Mandatory=$true)][string]$Upn)
    $user = Get-MgUser -UserId $Upn
    Revoke-MgUserSignInSession -UserId $user.Id
    Write-Host "[+] Refresh tokens revoked for $Upn. Force password reset + re-register MFA." -ForegroundColor Green
    # List auth methods so you can spot attacker-registered MFA devices
    Get-MgUserAuthenticationMethod -UserId $user.Id | Select-Object Id, CreatedDateTime
}

# ---- 4. HARDEN: Verify Conditional Access baseline exists ----
$policies = Get-MgIdentityConditionalAccessPolicy -All
Write-Host "`n[+] Conditional Access Policies in tenant:" -ForegroundColor Cyan
$policies | Select-Object DisplayName, State, CreatedDateTime | Format-Table -AutoSize
Write-Host "[!] REQUIRED controls to deploy if missing:" -ForegroundColor Yellow
Write-Host "    - Phishing-resistant MFA (FIDO2/WHfB) for all users, enforced for admins"
Write-Host "    - Block legacy authentication (basic auth cannot complete modern MFA relay safely)"
Write-Host "    - Token Protection (session binding) CA policy for Exchange Online & SharePoint"
Write-Host "    - Block authentication transfer / device code flow where not required"
Write-Host "    - Restrict consent: disable user consent to apps; require admin consent workflow"

# ---- 5. HARDEN: Disable user app consent (stops illicit grant persistence) ----
$authPolicy = Get-MgPolicyAuthorizationPolicy
if ($authPolicy.DefaultUserRolePermissions.PermissionGrantPoliciesAssigned -notcontains "ManagePermissionGrantsForSelf.microsoft-user-default-legacy") {
    Write-Host "[+] User self-consent already restricted." -ForegroundColor Green
} else {
    Write-Host "[!] User consent to apps appears enabled. Recommended: set to 'Do not allow user consent'" -ForegroundColor Red
    Write-Host "    Portal: Entra ID > Enterprise applications > Consent and permissions > User consent settings"
}

# ---- 6. AUDIT: Flag users with recently added authentication methods ----
$report = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $since" -All |
    Where-Object { $_.ActivityDisplayName -match "registered security info|Add authentication method|user registered security info" }
$report | Select-Object ActivityDateTime, ActivityDisplayName,
    @{N='Target';E={$_.TargetResources[0].UserPrincipalName}} | Format-Table -AutoSize