M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)

Detects Microsoft 365 audit "UserLoggedIn" events consistent with Tycoon 2FA phishing-as-a-service (PhaaS) adversary-in-the-middle (AiTM) activity: the Microsoft Authentication Broker requesting access where the object identifier matches Microsoft Graph or Exchange Online, or the Office web client application authenticating to itself, combined with Node.js-style user agents (node, axios, undici). Tycoon 2FA bypasses MFA by relaying authentication and capturing session material, often targeting Microsoft 365 and Gmail. Baseline legitimate automation and developer tooling before tuning.

Rule type: query
Rule indices:

• logs-o365.audit-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://any.run/malware-trends/tycoon/

Tags:

• Domain: Cloud
• Domain: Identity
• Domain: SaaS
• Data Source: Microsoft 365
• Data Source: Microsoft 365 Audit Logs
• Use Case: Threat Detection
• Threat: Tycoon2FA
• Tactic: Initial Access
• Tactic: Credential Access
• Resources: Investigation Guide

Version: 1
Rule authors:

• Elastic

Rule license: Elastic License v2

Review o365.audit.UserId, user_agent.original, source.ip or o365.audit.ActorIpAddress, and related Entra ID sign-in logs (azure.signinlogs) for the same session or time window.

Confirm whether the account owner intentionally authenticated and whether Node.js-style user agents (node, axios, undici) are expected for Microsoft Authentication Broker or Office web client flows in your environment.

• Correlate with azure.signinlogs for matching user principal name, IP, and session identifiers.
• Review Microsoft Graph or Exchange audit activity following the login for mailbox or data access anomalies.
• Hunt for other UserLoggedIn events from the same source with unusual user agents or rapid OAuth patterns.

• If malicious, revoke refresh tokens for the user, reset credentials per policy, and review conditional access outcomes.
• Block or monitor the source IP and escalate per incident procedures.

data_stream.dataset:"o365.audit" and event.category:"authentication" and event.action:"UserLoggedIn" and
(
    (
        o365.audit.ApplicationId:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
        o365.audit.ObjectId:(
            "00000002-0000-0ff1-ce00-000000000000" or "00000003-0000-0000-c000-000000000000"
        )
    ) or
    (
        o365.audit.ApplicationId:"4765445b-32c6-49b0-83e6-1d93765276ca" and
        o365.audit.ObjectId:"4765445b-32c6-49b0-83e6-1d93765276ca"
    )
) and user_agent.original:(node or axios* or undici)
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Initial Access
  • Id: TA0001
  • Reference URL: https://attack.mitre.org/tactics/TA0001/

• Technique:

  • Name: Phishing
  • Id: T1566
  • Reference URL: https://attack.mitre.org/techniques/T1566/

Framework: MITRE ATT&CK

• Tactic:

  • Name: Credential Access
  • Id: TA0006
  • Reference URL: https://attack.mitre.org/tactics/TA0006/

• Technique:

  • Name: Steal Web Session Cookie
  • Id: T1539
  • Reference URL: https://attack.mitre.org/techniques/T1539/