<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-adversary-in-the-middle-phishing
description: >-
  Detect adversary-in-the-middle (AiTM) phishing attacks that use reverse
  proxy frameworks to intercept credentials and session tokens in real time,
  bypassing multi-factor authentication through session cookie theft.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - aitm-phishing
  - session-hijacking
  - mfa-bypass
  - reverse-proxy
  - evilginx
  - token-theft
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1111"]
---

# Detecting Adversary-in-the-Middle Phishing

## Overview

AiTM phishing uses reverse proxy servers (Evilginx, Modlishka, Muraena) to sit
between the victim and legitimate authentication portal. The proxy captures
credentials AND session cookies in real time, bypassing MFA.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| Azure AD / Entra ID logs | Sign-in and audit log access |
| SIEM access | Splunk / Elastic / Sentinel |
| `jq` | JSON processing |

## Key Concepts

### AiTM Attack Flow

```
Victim -> Phishing URL -> Reverse Proxy -> Legitimate Auth Portal
                             |                      |
                     Captures creds          Returns session cookie
                     Captures cookie    <-   MFA completed by victim
                             |
                     Attacker replays cookie -> Authenticated session
```

### Detection Indicators

| Indicator | Confidence | Description |
|---|---|---|
| Impossible travel | High | Sign-in from proxy IP then attacker IP |
| New device + cookie replay | Critical | Session without full auth flow |
| Sign-in from known proxy IP | High | IP in Evilginx infrastructure |
| Non-compliant device access | High | Unmanaged device accessing data |

### MITRE ATT&CK Mapping

| Technique | ID | Description |
|---|---|---|
| Adversary-in-the-Middle | T1557 | Proxy-based interception |
| Steal Web Session Cookie | T1539 | Session cookie theft |

## Workflow

### 1. Detect Suspicious Sign-Ins

```bash
node agent.js analyze-signins --log-file /tmp/signin_logs.json
node agent.js detect-impossible-travel --log-file /tmp/signin_logs.json --max-speed-kmh 900
node agent.js detect-session-anomaly --log-file /tmp/signin_logs.json
```

### 2. Generate Detection Rules

```bash
node agent.js generate-kql --detection-type aitm-signin
node agent.js generate-sigma --detection-type session-replay
node agent.js generate-splunk --detection-type impossible-travel
```

### 3. Hardening

```bash
node agent.js hardening-report --tenant company.com
node agent.js audit-mfa --log-file /tmp/signin_logs.json
```

## Detection

```yaml
title: Adversary In The Middle Phishing Detection
id: 52bce004-a4b5-430f-bddb-373aec87dde7
status: experimental
description: Detects suspicious activity related to detecting adversary in the middle phishing techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1557
  - attack.t1111
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Suspicious sign-ins detected | Anomalous patterns flagged |
| Impossible travel identified | Speed exceeds threshold |
| Detection rules generated | KQL/Sigma/SPL rules produced |
| Hardening gaps identified | Non-phishing-resistant MFA flagged |

## References

- [MITRE ATT&CK T1557](https://attack.mitre.org/techniques/T1557/)
- [Microsoft AiTM Detection Guide](https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/)
- [CISA Phishing Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
