Detections: AiTM, Device-Code Phishing and App Takeover

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.

What is covered

• Session theft (Storm-2755). A fake Microsoft 365 sign-in page relays the real sign-in, so the victim completes MFA and the attacker keeps the session. Fluency flags the proxied sign-in, any later reuse of that session from a new network, the mail and file access that follows, and the oddly named inbox rules used to hide replies.
• Device-code phishing (Storm-2372). A fake Teams meeting invitation gets the user to enter a device code that hands the attacker their tokens. Fluency alerts when the approved session turns up from another network or country, including when a device is registered for persistence right after the approval.
• Tenant takeover (Storm-3119). With a compromised Global Administrator, the attacker sets up an app with broad permissions and a client secret of its own, which keeps working after the admin's password is reset. Fluency follows one app across registration, permissions, secrets and actions on users for 72 hours, and raises one alert per app.

The release also adds detections for federation and federated-credential changes, elevated access, privileged role assignments, high-risk sign-ins, MFA fatigue and MFA fraud reports, per-user brute force, and correct passwords blocked by Conditional Access.

In all: 19 new alerting rules, 12 context rules that add events to the timeline without raising alerts, and 5 older rules retired or removed.

What to expect

• Data sources. The Entra ID rules need Entra ID sign-in and audit logs (Entra ID Audit via Event Hubs); the Office 365 rules need the Microsoft 365 unified audit log (Office365 Audit API). An instance with only the Microsoft 365 audit log still gets the AiTM capture, mail and file activity, broker-phishing and inbox-rule detections.
• Alert volume. The campaign detections are designed to be rare. The medium-severity rules may fire on planned admin work, and on users blocked by your own Conditional Access policies.
• Fewer MFA-method alerts. Registering or changing an authentication method is now recorded on the user's timeline instead of raising a high alert, so a passkey rollout no longer raises one alert per user.

The full rule list, triage guidance for each alert, and the retired rules are in the Entra ID Detection Update release notes.

Splash Summary

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.