AegisAI Perspectives · 077
Look after the login: a stolen session passes MFA, so check sign-in anomalies first, then hidden inbox rules, then unusual mail sent from the account.
Look after the login, because a stolen session token works even when the owner satisfied multifactor authentication1. AegisAI reads sign-ins and mailbox activity per account and raises one explained finding when behavior stops matching the owner20. The checks below work in Microsoft 365 with or without it.
MFA checks the person at sign-in, and the attacker steals what comes after it. A token theft attack replays tokens issued to a user, even if that user has satisfied multifactor authentication. Because authentication requirements are met, the attacker is granted access to organizational resources with the stolen token2.
The common route is a phishing proxy. Microsoft's Adversary in the Middle detection fires when an authentication session is linked to a malicious reverse proxy3. In that attack the adversary can intercept the user's credentials, including tokens issued to the user4. The page on how account takeover works explains the attack itself; this page is the checklist for spotting it.
Start with sign-ins, because the stolen session has to be used from somewhere. Entra ID Protection flags an anomalous token when the token shows an unusual lifetime or is played from an unfamiliar location5. It flags atypical travel when two sign-ins come from distant locations and one of them is atypical for the user6.
Look at the device and the network as well. Unfamiliar sign-in properties include the IP address and the device, among others7. A finance user who always signs in from one laptop and suddenly appears on a new browser from a hosting network deserves a closer look. Filter for non-interactive sign-ins too: Microsoft says an unfamiliar properties detection on a non-interactive sign-in deserves increased scrutiny due to the risk of token replay attacks24. Those are the background sign-ins an app makes with a refresh token, which is exactly what a stolen session uses.
Expect gaps for new staff. New users sit in a learning mode for unfamiliar sign-in properties, and the minimum duration is five days8. An account created this week can be hijacked before the detection has a baseline.
Check your license before you trust an empty report. Full details on most risk detections require Microsoft Entra ID P211. On a lower plan, read the raw sign-in logs and the mailbox rules by hand instead.
Search the mailbox rules next, because a hijacked mailbox is usually set up to hide replies. Microsoft lists rules that automatically forward email to unknown addresses as a symptom of a compromised mailbox12. Entra ID Protection raises a detection when suspicious rules that delete or move messages or folders are set on a user's inbox9.
A forwarding rule that copies all mail to an outside address is its own detection10. Run Get-InboxRule with the IncludeHidden switch, which reviews all Inbox rules, including hidden ones, for rules that redirect or forward messages13. A rule named with a single dot that moves mail about invoices to a little used folder is a strong sign.
Account changes count too. Frequent password changes or unexplained account lockouts can indicate a compromised mailbox14. So can a mailbox that Microsoft 365 has blocked from sending email25, which usually means the account already sent a burst of spam or phishing. Treat a send block on a finance or executive account as a hijack until the sign-in records prove otherwise.
Read the sent mail last, because the hijacked account now phishes from inside. That mail passes every sender check, since it really is the account sending21. The text is often polished: the FBI says criminals use AI-generated text to appear believable to a reader in spear phishing schemes18.
Watch for a burst of internal mail asking colleagues to sign in, or a reply in a real invoice thread with new bank details. Business email compromise cost $3,046,598,558 in 2025, per the FBI IC3 annual report17.
Pull the account's sign-ins for the past week and mark every new device or location.
Check Entra ID Protection for anomalous token or Adversary in the Middle detections on the account.
Run Get-InboxRule with IncludeHidden and record every rule that forwards, moves or deletes mail.
Search the account's sent mail for messages to many colleagues or to finance contacts.
Revoke all sessions with Revoke-MgUserSignInSession, which also invalidates existing refresh tokens16.
Reset the password and delete app passwords, because they aren't automatically revoked when you reset the password15.
Remove the bad rules, then warn anyone who received mail from the account during the window.
| Sign | Where to check | License note |
|---|---|---|
| Token played from an unfamiliar location | Entra ID Protection, anomalous token | Full details need Entra ID P2 |
| Session linked to a phishing proxy | Entra ID Protection, Adversary in the Middle | Full details need Entra ID P2 |
| Sign-ins from distant places close together | Entra ID Protection, atypical travel | Raw sign-in logs on lower plans |
| Hidden rule moving or deleting mail | Get-InboxRule with IncludeHidden | Any Exchange Online admin |
| Forwarding to an outside address | Get-InboxRule, forwarding detection | Any Exchange Online admin |
| Unusual mail sent from the account | Sent items and message trace | Any Exchange Online admin |
Illustrative example, figures are fictional. A controller at a 600 person firm approves a sign-in prompt on a fake document page at 09:12. At 09:31 the account signs in from a new browser on a hosting network, and at 09:36 a rule named "." starts moving mail containing "invoice" to an archive folder. The admin finds the rule with Get-InboxRule, revokes all sessions, deletes two app passwords and recalls a payment change sent to 14 suppliers.
A phishing proxy keeps the session cookie, so no second factor is asked for19. AegisAI agents read sign-ins and mailbox activity per account, and raise one explained finding when behavior stops matching the owner. Every finding comes with recommended steps, and your team acts in Entra ID, Okta or Google Workspace22. Early access runs on the connection you already have, review-only, with no MX change23.
Track three numbers for the month after you start these checks.
The attacker steals the session after sign-in. A token theft attack replays tokens issued to a user even after MFA was satisfied, so the attacker never faces the second factor.
Often a sign-in from a new device or location shortly after the owner's own login. Entra ID Protection flags tokens played from an unfamiliar location. A new inbox rule soon after is a stronger sign.
Not on its own. Revoke all sessions as well, and delete app passwords, because they aren't automatically revoked when you reset the password.
Partly. Full details on most risk detections need P2, but any Exchange Online admin can run Get-InboxRule with IncludeHidden and read the account's sent mail.
It really is the colleague's account, so every sender check passes. AI-generated text also makes the request read naturally.
