Azure Sign-In With Axios User Agent

SIGMA detection rule by Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · NOASSERTION

Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating potential use of automated credential harvesting or AiTM phishing infrastructure. Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens. When triaging results, analysts should: - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass. - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts. - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.

title: Azure Sign-In With Axios User Agent
id: ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
status: experimental
description: |
    Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios",
    indicating potential use of automated credential harvesting or AiTM phishing infrastructure.
    Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens.
    When triaging results, analysts should:
        - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass.
        - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts.
        - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.
references:
    - https://thehackernews.com/2025/09/axios-abuse-and-salty-2fa-kits-fuel.html
    - https://www.proofpoint.com/us/blog/threat-insight/http-client-tools-exploitation-account-takeover-attacks
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-04-28
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1557
    - detection.threat-hunting
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        userAgent|contains: 'axios'
    condition: selection
falsepositives:
    - Legitimate internal or third-party applications built with Node.js that use Axios as their HTTP client for authenticating against Azure/Entra ID.
level: low

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

246c3666-b44d-4524-abbc-d6b6d508f98d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion