When Your UPN Appears Inside A URL: Detecting AiTM & Session Theft

Adversary-in-the-Middle (AiTM) frameworks fundamentally change how phishing operates. Instead of stealing passwords from fake login pages, they proxy legitimate authentication services and intercept sessions in real time.

How AiTM Infrastructure Works

Modern AiTM kits typically:

• Proxy legitimate Microsoft or cloud authentication portals
• Relay credentials and MFA prompts in real time
• Capture authenticated session cookies after successful login
• Extract OAuth tokens or session identifiers
• Replay valid sessions to bypass MFA enforcement

Because the victim interacts with a real authentication page, traditional indicators such as invalid certificates, obvious fake domains, or credential entry errors may not exist.

Why UPNs Appear in Malicious URLs

To track and manage active victims, many AiTM frameworks embed victim identifiers directly into URLs.

These identifiers may appear in:

• Query string parameters
• URL path segments
• Redirect tokens
• Encoded tracking values
• Session correlation IDs

Example attacker use cases:

• Mapping a specific victim to an active proxy session
• Correlating credentials with captured session cookies
• Linking authentication attempts to backend control panels
• Automating post-authentication token replay

While this behavior benefits the attacker, it introduces a detectable artifact.

Why This Is Abnormal

Under standard enterprise browsing behavior:

• SaaS platforms do not require embedding a full UPN inside third-party public URLs
• Browsers do not normally initiate outbound requests containing the user’s own identity in the destination URL
• Identity values are typically transmitted via secure headers, tokens, or encrypted session exchanges — not visible URL strings

Therefore, when a browser process connects to a public IP and the RemoteUrl contains the initiating user’s UPN, it often indicates:

• Active phishing infrastructure
• Session hijacking attempts
• Credential harvesting
• Identity tracking by malicious proxy frameworks

This makes the signal both subtle and high-confidence when properly filtered.

This rule focuses on real outbound browser behavior, not static IOC lists.

The detection identifies:

• Successful outbound connections Initiated by common browser processes (chrome.exe, msedge.exe, firefox.exe) to public IP infrastructure, where the Remote URL contains the user’s UPN
• With contextual enrichment to ensure the correct UPN is mapped to the device

Rather than detecting known phishing domains, this method detects victim-specific exploitation patterns, making it resilient against domain rotation and fast-flux infrastructure.

The following query represents the reference implementation behind:

UPN Detected in URL – Possible AiTM Attack

Thresholds and filters can be tuned based on organizational requirements.

let GetUsersUPN = DeviceNetworkEvents 

| union DeviceLogonEvents 

| union DeviceEvents 

| where TimeGenerated > ago(14d) 

| where isnotempty(InitiatingProcessAccountUpn) 

| summarize arg_max(TimeGenerated, *) by DeviceName, InitiatingProcessAccountUpn 

| project DeviceName, UPN = InitiatingProcessAccountUpn; 

DeviceNetworkEvents 

| where TimeGenerated > ago(1h) 

| where ActionType == "ConnectionSuccess" 

| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe") 

| join kind=leftouter GetUsersUPN on DeviceName 

| extend InitiatingProcessAccountUpn = iff(isempty(InitiatingProcessAccountUpn), UPN, InitiatingProcessAccountUpn) 

| where isnotempty(InitiatingProcessAccountUpn) 

| where not(ipv4_is_private(RemoteIP)) 

| where RemoteUrl has (InitiatingProcessAccountUpn) 

| extend Domain = extract(@"https?:\/\/([^\/]+)", 1, RemoteUrl) 

| project 

    TimeGenerated, 

    InitiatingProcessAccountUpn, 

    Domain, 

    RemoteUrl, 

    InitiatingProcessFileName, 

    ActionType, 

    DeviceName, 

    DeviceId, 

    RemoteIP, 

    RemotePort

Each result represents:

• A real browser-initiated outbound connection
• To a public-facing remote endpoint
• Where the full UPN appears inside the URL
• With device and network context for investigation

This is high-value telemetry because it shows user-driven activity, not just blocked attempts or passive indicators.

Security teams should treat this as a potential live phishing or session theft event.

This analytic does not:

• Confirm session cookie theft
• Confirm successful account compromise
• Detect infrastructure that does not embed UPNs

It surfaces a high-confidence anomaly that frequently precedes or accompanies AiTM exploitation.

Organizations should baseline legitimate identity workflows to reduce false positives from internal applications or testing environments.

When this detection triggers, recommended actions include:

1. Immediately validate the remote domain reputation
2. Inspect the full URL structure and parameters
3. Review sign-in logs for suspicious or anomalous authentication
4. Invalidate active sessions for the affected account
5. Reset user credentials and enforce reauthentication
6. Investigate token replay or impossible travel patterns
7. Block identified phishing infrastructure

If session theft is confirmed, treat the incident as account compromise, not just phishing exposure.

Traditional phishing detection focuses on email delivery or domain reputation.

AiTM attacks bypass those layers by:

• Using legitimate cloud authentication pages
• Operating through reverse proxies
• Capturing session cookies instead of just passwords
• Avoiding obvious malware artifacts

This detection surfaces a subtle behavioral anomaly:

“Your identity embedded inside an external URL during active browsing.”

That signal is difficult for attackers to suppress and difficult for traditional controls to detect.

• Microsoft Defender XDR
  • Provides device network telemetry, process context, and browser activity visibility.
• Microsoft Sentinel
  • Enables behavioral analytics, correlation, enrichment, and alerting.
• Microsoft Entra ID
  • Authentication telemetry used to validate potential credential or session abuse.

Wizard Cyber specializes in behavior-driven detection engineering across Microsoft security platforms.

We design analytics that focus on:

• Identity abuse patterns, not just malware signatures
• MFA bypass and session theft detection
• High-confidence behavioral anomalies
• Actionable alerts with embedded investigation context

By focusing on how attackers operate in modern cloud environments, we help organizations detect AiTM campaigns and session hijacking before privilege escalation or data exfiltration occurs.