I'm looking for advice on how to protect against AiTM (Adversary-in-the-Middle) attacks, specifically concerning session token hijacking in Microsoft 365. From what I understand, these attacks often involve a malicious domain that mimics the Microsoft 365 login page. When victims enter their credentials and complete multi-factor authentication (MFA), the attacker can intercept the session token, allowing them to access resources without needing to go through MFA again. Assuming a phishing email succeeds in bypassing Safe Links, I'd like to know if the following security measures are effective in preventing such attacks:
1. Conditional Access – Require compliant devices: This strategy involves setting up a policy that mandates the device to be compliant. The idea is that if an attacker tries to use the stolen session token from their own device, it would fail since that device wouldn't be compliant with Intune.
2. Risk-based Conditional Access with re-authentication: This means enforcing MFA and requiring re-authentication for suspicious logins to block unauthorized access, even if the attacker has already entered the password.
Are these methods reliable for protecting against AiTM or session token hijacking? Are there any additional or better controls within Microsoft 365 that I should consider?
3 Answers
Don't forget, there’s also an option in the Conditional Access Policies for session management that requires token protection for sign-in sessions. This is available for Windows and in preview for MacOS and iOS. I had already established my policies but later found this baseline and made adjustments. Check it out if you're building out your security protocols! [Consider this guide](https://github.com/j0eyv/ConditionalAccessBaseline) for ideas.
Those two steps are solid starts! Besides that, think about using shorter session times and non-persistent sessions for highly critical areas like Entra and Azure. Adding phishing-resistant MFA for these sections is also a wise choice. Plus, token protection is definitely a must. An interesting tactic I've noticed involves adding custom CSS to the login page that provides alerts if the user tries to log in via an unrecognized URL—giant red warnings can go a long way!
You're on the right track! That first measure is super effective. But the biggest game-changer against AiTM attacks is to implement phishing-resistant MFA using FIDO2 or Windows Hello for Business (WHFB). Pairing that with your Conditional Access policies really strengthens your defense by preventing token theft altogether and reducing any risk if something slips through.
The 'Check by Cyberdrain' browser extension is a useful tool for spotting phishing login pages.