- Published
- Source
- Huntress
- Filed under
- Microsoft, SOC & SIEM, Attacks
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Adversary-in-the-Middle
Credential Access, CollectionWhat a defender checks
- Look for sign-ins where a session token reappears from a new device or location.
- Revoke sessions and reset passwords for anyone who entered credentials.
- Move to phishing-resistant MFA (passkeys, FIDO2), which a proxy can't relay.
Build the skillBlue Team Engineer · Identity & Access Management Engineering
Account Manipulation
Persistence, Privilege EscalationWhat a defender checks
- Audit new inbox and forwarding rules, especially ones that hide or forward mail.
- Review OAuth app consents and credentials added to apps.
- Alert on new privileged role assignments.
Build the skillBlue Team Analyst · Identity & Access Monitoring
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-200 exam training
Defender and Sentinel in the headlines? That's the SC-200 toolkit.
Tutor-led SC-200 preparation: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- Microsoft Sentinel and Defender XDR
- Incident response across Microsoft 365
- Threat hunting with KQL
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
