Sigma rule: Azure Sign-In With Axios User Agent

Rule

Title

Azure Sign-In With Axios User Agent

Status

experimental

Level

low

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Date

2026-04-28

File

rules-threat-hunting/cloud/azure/signin_logs/azure_ad_signin_axios_user_agent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios",
indicating potential use of automated credential harvesting or AiTM phishing infrastructure.
Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens.
When triaging results, analysts should:
- Check the sign-in risk level, MFA status, and conditional access results for signs of bypass.
- Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts.
- Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.

Log source

product

azure

service

signinlogs

Detection

selection:
    userAgent|contains: 'axios'
condition: selection

False positives (as the rule lists them)

• Legitimate internal or third-party applications built with Node.js that use Axios as their HTTP client for authenticating against Azure/Entra ID.

Tags

• attack.credential-access
• attack.collection
• attack.t1557
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1557

References

• https://thehackernews.com/2025/09/axios-abuse-and-salty-2fa-kits-fuel.html
• https://www.proofpoint.com/us/blog/threat-insight/http-client-tools-exploitation-account-takeover-attacks

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/cloud/azure/signin_logs/azure_ad_signin_axios_user_agent.yml