N0va Phishkit AiTM Campaigns Target US and EU Enterprises: Detection and Identity Hardening Guide

---
title: AiTM Phishing Proxy Domain Patterns Targeting Microsoft 365 Login
description: Detects HTTP requests to lookalike authentication domains consistent with AiTM reverse-proxy phishing kits (e.g., N0va) impersonating Microsoft Entra ID login infrastructure. Typosquat and concatenated patterns such as 'login-microsoftonline', 'microsoftonline-login', or IdP branding embedded in non-Microsoft domains are high-fidelity indicators.
logsource:
  category: proxy
  product: webserver
detection:
  selection_brand:
    c-uri|contains:
      - '/common/oauth2/'
      - '/oauth2/authorize'
      - 'login.microsoftonline'
      - 'login.live.com'
  selection_lookalike:
    cs-host|contains:
      - 'login-microsoftonline'
      - 'microsoftonline-'
      - 'office365-'
      - '-office365'
      - 'microsoft-login'
      - 'login-office'
      - 'okta-verify-'
      - '-okta.login'
  filter_microsoft_ip:
    cs-host|endswith:
      - '.microsoftonline.com'
      - '.microsoft.com'
      - '.live.com'
      - '.okta.com'
  condition: (selection_brand and not filter_microsoft_ip) or (selection_lookalike and not filter_microsoft_ip)
fields:
  - c-ip
  - cs-host
  - c-uri
  - cs-referrer
  - sc-status
falsepositives:
  - Legitimate third-party integrations redirecting to Microsoft login (rare when hostname is a lookalike)
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1557
  - attack.collection
status: experimental
author: Security Arsenal
date: 2026/09/15
---
title: Suspicious Process Access to Browser Session Cookie Stores
description: Detects non-browser processes accessing Chrome/Edge/Brave cookie databases or the Local State file, consistent with post-compromise session cookie theft tooling. Relevant to AiTM intrusions where attackers additionally loot local session material, and to infostealer follow-on activity after successful phishing.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\Default\Cookies'
      - '\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Cookies'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies'
      - '\AppData\Local\Google\Chrome\User Data\Local State'
      - '\AppData\Local\Microsoft\Edge\User Data\Local State'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection and not filter_browsers
fields:
  - Image
  - TargetFilename
  - User
  - ProcessId
falsepositives:
  - Endpoint backup or EDR tooling legitimately scanning user profiles
  - Browser extension sync utilities
level: high
tags:
  - attack.credential_access
  - attack.t1539
status: experimental
author: Security Arsenal
date: 2026/09/15
---
title: OAuth Application Consent Grant with High-Risk Mail and Graph Scopes
description: Detects 'Consent to application' events in Azure audit logs where delegated permissions such as Mail.Read, Mail.Send, Files.ReadWrite.All, or offline_access are granted — a common persistence and data-access step after AiTM account compromise.
logsource:
  product: azure
  service: auditlogs
detection:
  selection_operation:
    operationName: 'Consent to application'
  selection_scopes:
    properties.targetResources|contains:
      - 'Mail.Read'
      - 'Mail.Send'
      - 'Mail.ReadWrite'
      - 'Files.ReadWrite.All'
      - 'offline_access'
      - 'User.Read.All'
      - 'Directory.Read.All'
  condition: all of selection_*
fields:
  - initiatedBy.user.userPrincipalName
  - properties.targetResources
  - additionalDetails
  - result
falsepositives:
  - Legitimate enterprise app onboarding — baseline approved publishers and correlate with change records
level: medium
tags:
  - attack.persistence
  - attack.t1528
  - attack.collection
status: experimental
author: Security Arsenal
date: 2026/09/15

// Hunt for AiTM session token replay: MFA-claim reuse from novel infrastructure
let lookback = 14d;
let huntwindow = 24h;
let KnownIPs =
    SigninLogs
    | where TimeGenerated between (ago(lookback) .. ago(huntwindow))
    | where ResultType == 0
    | summarize by UserPrincipalName, IPAddress, tostring(NetworkLocationDetails);
SigninLogs
| where TimeGenerated > ago(huntwindow)
| where ResultType == 0
| where AuthenticationRequirement == "multiFactorAuthentication"
// MFA satisfied by claim in token rather than fresh factor — classic token replay indicator
| extend AuthDetails = tostring(Status)
| extend MfaDetail = todynamic(MfaDetail)
| where MfaDetail.authMethod =~ "Previously satisfied" or tostring(MfaDetail) contains "Previously satisfied"
| extend ASN = tostring(NetworkLocationDetails)
| join kind=leftanti (KnownIPs) on UserPrincipalName, IPAddress
| extend RiskState = tostring(RiskState), RiskDetail = tostring(RiskDetail)
| project TimeGenerated, UserPrincipalName, IPAddress, ASN, Location, AppDisplayName,
          DeviceDetail, Browser, OS, AuthenticationRequirement, RiskState, RiskDetail, CorrelationId
| sort by TimeGenerated desc

// Inbox rule creation following suspicious sign-in — BEC / mail hiding behavior
let SuspiciousSignins =
    SigninLogs
    | where TimeGenerated > ago(24h)
    | where RiskState in ("atRisk", "confirmedCompromised")
       or RiskDetail has_any ("anonymizedIPAddress", "unfamiliarFeatures", "unlikelyTravel")
    | summarize SigninTime=min(TimeGenerated), SigninIP=make_set(IPAddress) by UserPrincipalName, CorrelationId;
OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation in ("New-InboxRule", "Set-InboxRule", "UpdateInboxRules")
| extend UserId = tostring(UserId)
| extend Params = todynamic(Parameters)
| mv-expand Params
| extend RuleName = tostring(Params.Value)
| join kind=inner (SuspiciousSignins) on $left.UserId == $right.UserPrincipalName
| where TimeGenerated between (SigninTime .. SigninTime + 6h)
| project TimeGenerated, UserId, Operation, RuleName, ClientIP, SigninIP, ResultStatus

-- Hunt: Non-browser processes accessing browser session cookie stores
-- Deploy as a notebook query or artifact (Generic.Forensics.LocalHunt style)
LET browser_paths = {
  SELECT * FROM split(string='''
C:/Users/*/AppData/Local/Google/Chrome/User Data/Default/Network/Cookies
C:/Users/*/AppData/Local/Microsoft/Edge/User Data/Default/Network/Cookies
C:/Users/*/AppData/Local/Google/Chrome/User Data/Local State
C:/Users/*/AppData/Local/Microsoft/Edge/User Data/Local State''', sep='\n')
}

LET cookie_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/Users/*/AppData/{Local/ Google,Local/Microsoft}*/**/Cookies')
WHERE Size > 0

-- Enumerate processes with handles/command lines referencing cookie paths
LET proc_hits = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(Cookies|Local State|Network\\\\Cookies)'
   AND NOT Exe =~ '(?i)(chrome|msedge|brave|firefox)\.exe$'

SELECT 'ProcessAccess' AS FindingType,
       Pid, Name, Exe, CommandLine, Username, CreateTime,
       '' AS FilePath, '' AS Mtime
FROM proc_hits
UNION ALL
SELECT 'RecentCookieStoreModification' AS FindingType,
       0 AS Pid, '' AS Name, '' AS Exe, '' AS CommandLine, '' AS Username,
       '' AS CreateTime,
       FullPath AS FilePath, Mtime
FROM cookie_files
WHERE Mtime > Now() - 86400  -- modified in last 24h; correlate with incident window

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Users
# N0va / AiTM Phishing Response & Hardening Script — Security Arsenal
# Run with: Connect-MgGraph -Scopes "Policy.Read.All","User.Read.All","Directory.Read.All","UserRevokeSessions.All"

Connect-MgGraph -Scopes "Policy.Read.All","User.Read.All","Directory.Read.All","UserRevokeSessions.All" -NoWelcome

# 1) Audit Conditional Access policies for token protection / phishing-resistant MFA coverage
Write-Host "`n=== Conditional Access Policy Audit ===" -ForegroundColor Cyan
$caPolicies = Get-MgIdentityConditionalAccessPolicy -All
$tokenProtection = $caPolicies | Where-Object {
    $_.State -eq 'enabled' -and
    ($_.SessionControls.SecureSignInSession -ne $null -or $_.GrantControls.AuthenticationStrength -ne $null)
}
if (-not $tokenProtection) {
    Write-Warning "No enabled CA policy enforces token protection or an authentication strength (phishing-resistant MFA). This is the primary gap N0va exploits."
} else {
    $tokenProtection | Select-Object DisplayName, State | Format-Table
}

# 2) Revoke sessions for users flagged as risky or confirmed compromised
Write-Host "`n=== Revoking Sessions for At-Risk Users ===" -ForegroundColor Cyan
$riskyUsers = Get-MgIdentityProtectionRiskyUser -Filter "riskState eq 'atRisk' or riskState eq 'confirmedCompromised'" -All
foreach ($u in $riskyUsers) {
    Invoke-MgInvalidateUserRefreshToken -UserId $u.Id
    Write-Host "Revoked refresh tokens: $($u.UserPrincipalName) [$($u.RiskLevel)]" -ForegroundColor Yellow
}

# 3) Hunt for risky OAuth consent grants (persistence after AiTM compromise)
Write-Host "`n=== OAuth Consent Grant Audit (high-risk scopes) ===" -ForegroundColor Cyan
$highRiskScopes = 'Mail.Read','Mail.Send','Mail.ReadWrite','Files.ReadWrite.All','offline_access','Directory.Read.All'
$grants = Get-MgOauth2PermissionGrant -All
foreach ($g in $grants) {
    foreach ($scope in $highRiskScopes) {
        if ($g.Scope -match [regex]::Escape($scope)) {
            $sp = Get-MgServicePrincipal -ServicePrincipalId $g.ClientId -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                AppDisplayName = $sp.DisplayName
                Publisher      = $sp.PublisherName
                Scope          = $g.Scope
                ConsentType    = $g.ConsentType
                CreatedTime    = $sp.CreatedDateTime
            }
        }
    }
}

# 4) Verify legacy auth is blocked (AiTM kits also abuse IMAP/POP fallback)
Write-Host "`n=== Legacy Auth Check ===" -ForegroundColor Cyan
$legacyBlocked = $caPolicies | Where-Object {
    $_.State -eq 'enabled' -and
    $_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -and
    $_.GrantControls.BuiltInControls -contains 'block'
}
if (-not $legacyBlocked) { Write-Warning "Legacy authentication is not blocked tenant-wide. Block it now." }
else { Write-Host "Legacy auth block policy present." }

Disconnect-MgGraph