[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DAZRR6NS2931F8NE5DDDM":3,"skill-same:01M71DAZRR6NS2931F8NE5DDDM":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71DAZRR6NS2931F8NE5DDDM","phishing-aitm-detect",null,"Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Faitm\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"phishing","detect","aitm","phishing aitm detect","attacks","sonnet","t1003","credential-theft","steal","defense","read","at","co","de","Bash","cybersecurity","respond","adversary-in-the-middle","cm","t1566","2026-11-10 10:12:30",false,"---\nname: phishing-aitm-detect\ndescription: Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.\ndomain: cybersecurity\nsubdomain: phishing-defense\ntags:\n- aitm\n- evilproxy\n- evilginx\n- phishing\n- mfa-bypass\n- session-hijacking\n- reverse-proxy\n- credential-theft\nnist_csf:\n- PR.AT-01\n- DE.CM-09\n- RS.CO-02\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1059\n- T1550\n- T1566\n- T1583.001\ncwe:\n- CWE-384\ncapec: []\n---\n\n# Performing Adversary-in-the-Middle Phishing Detection\n\n## Overview\nAdversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing adversary in the middle phishing detection\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Azure AD \u002F Entra ID Conditional Access policies\n- SIEM with authentication log ingestion (Azure AD sign-in logs)\n- Web proxy with SSL inspection and URL categorization\n- Endpoint Detection and Response (EDR) solution\n- FIDO2\u002Fphishing-resistant MFA capability\n\n## Key Concepts\n\n### How AiTM Works\n1. Victim receives phishing email with link to attacker-controlled domain\n2. Attacker domain runs reverse proxy that mirrors legitimate login page\n3. Victim enters credentials on proxied page; credentials captured in transit\n4. Reverse proxy forwards credentials to real authentication service\n5. MFA challenge sent to victim; victim completes MFA on proxied page\n6. Attacker captures session cookie returned by legitimate service\n7. Attacker replays session cookie to access victim's account without MFA\n\n### Major AiTM Kits (2025)\n| Kit | Type | Primary Targets | Evasion |\n|---|---|---|---|\n| Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile |\n| EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation |\n| Evilginx | Open-source | Any web application | Custom phishlets |\n| Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks |\n| NakedPages | PhaaS | Multiple | Minimal infrastructure |\n\n### Detection Indicators\n- Authentication from unusual IP not matching user profile\n- Session cookie reuse from different IP\u002Fdevice than authentication\n- Login page served from non-Microsoft\u002Fnon-Google infrastructure\n- CDN requests to legitimate auth providers from phishing domains\n- Impossible travel between authentication and session usage\n\n## Workflow\n\n### Step 1: Deploy Phishing-Resistant MFA\n- Implement FIDO2 security keys or Windows Hello for Business for high-value accounts\n- Configure Conditional Access to require phishing-resistant MFA for admins\n- Enable certificate-based authentication where possible\n- Disable SMS and voice MFA for privileged accounts\n- AiTM cannot intercept FIDO2 because authentication is bound to origin domain\n\n### Step 2: Configure Conditional Access Policies\n- Require compliant\u002Fmanaged device for sensitive application access\n- Block authentication from anonymous proxies and Tor exit nodes\n- Enforce token binding to limit session cookie replay\n- Configure continuous access evaluation (CAE) for real-time token revocation\n- Implement sign-in risk policies that require re-authentication for risky sign-ins\n\n### Step 3: Build AiTM Detection Rules\n- Alert on sign-in followed by session from different IP within 10 minutes\n- Detect authentication where proxy IP does not match user's expected location\n- Monitor for impossible travel patterns in session usage\n- Alert on inbox rules created immediately after authentication (common post-compromise)\n- Detect new MFA method registration from suspicious sign-in\n\n### Step 4: Monitor Web Proxy for AiTM Infrastructure\n- Log and analyze DNS queries to newly registered domains\n- Detect connections to known PhaaS infrastructure IPs\n- Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains\n- Monitor for SSL certificates issued to domains mimicking corporate login pages\n- Block access to known EvilProxy\u002FEvilginx infrastructure via threat intelligence\n\n### Step 5: Implement Post-Compromise Detection\n- Alert on mailbox forwarding rules created after suspicious authentication\n- Detect OAuth app consent after AiTM sign-in\n- Monitor for email sending patterns indicating BEC follow-up\n- Alert on SharePoint\u002FOneDrive mass download after session hijack\n- Track lateral movement from compromised account\n\n## Tools & Resources\n- **Microsoft Entra ID Protection**: Risk-based Conditional Access\n- **Azure AD Sign-in Logs**: Authentication event analysis\n- **Okta ThreatInsight**: AiTM proxy detection at IdP level\n- **Sekoia TDR**: AiTM campaign tracking and intelligence\n- **Evilginx (defensive)**: Understanding attack mechanics for detection\n\n## Validation\n- Phishing-resistant MFA blocks AiTM session capture in test scenario\n- Conditional Access denies session replay from different device\u002FIP\n- SIEM alerts fire on simulated AiTM sign-in patterns\n- Web proxy blocks connections to known PhaaS infrastructure\n- Post-compromise rules detect inbox rule creation after suspicious auth\n","# Performing Adversary-in-the-Middle Phishing Detection\n\n## Overview\nAdversary-in-the-Middle (AiTM) phishing attacks use reverse-proxy infrastructure to sit between the victim and the legitimate authentication service, intercepting both credentials and session cookies in real time. This allows attackers to bypass multi-factor authentication (MFA). The most prevalent PhaaS kits in 2025 include Tycoon 2FA, Sneaky 2FA, EvilProxy, and Evilginx. Over 1 million PhaaS attacks were detected in January-February 2025 alone. These attacks have evolved from QR codes to HTML attachments and SVG files for link distribution.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing adversary in the middle phishing detection\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n- Azure AD \u002F Entra ID Conditional Access policies\n- SIEM with authentication log ingestion (Azure AD sign-in logs)\n- Web proxy with SSL inspection and URL categorization\n- Endpoint Detection and Response (EDR) solution\n- FIDO2\u002Fphishing-resistant MFA capability\n\n## Key Concepts\n\n### How AiTM Works\n1. Victim receives phishing email with link to attacker-controlled domain\n2. Attacker domain runs reverse proxy that mirrors legitimate login page\n3. Victim enters credentials on proxied page; credentials captured in transit\n4. Reverse proxy forwards credentials to real authentication service\n5. MFA challenge sent to victim; victim completes MFA on proxied page\n6. Attacker captures session cookie returned by legitimate service\n7. Attacker replays session cookie to access victim's account without MFA\n\n### Major AiTM Kits (2025)\n| Kit | Type | Primary Targets | Evasion |\n|---|---|---|---|\n| Tycoon 2FA | PhaaS | Microsoft 365, Google | CAPTCHA, Cloudflare turnstile |\n| EvilProxy | PhaaS | Microsoft 365, Google, Okta | Random URLs, IP rotation |\n| Evilginx | Open-source | Any web application | Custom phishlets |\n| Sneaky 2FA | PhaaS | Microsoft 365 | Anti-bot checks |\n| NakedPages | PhaaS | Multiple | Minimal infrastructure |\n\n### Detection Indicators\n- Authentication from unusual IP not matching user profile\n- Session cookie reuse from different IP\u002Fdevice than authentication\n- Login page served from non-Microsoft\u002Fnon-Google infrastructure\n- CDN requests to legitimate auth providers from phishing domains\n- Impossible travel between authentication and session usage\n\n## Workflow\n\n### Step 1: Deploy Phishing-Resistant MFA\n- Implement FIDO2 security keys or Windows Hello for Business for high-value accounts\n- Configure Conditional Access to require phishing-resistant MFA for admins\n- Enable certificate-based authentication where possible\n- Disable SMS and voice MFA for privileged accounts\n- AiTM cannot intercept FIDO2 because authentication is bound to origin domain\n\n### Step 2: Configure Conditional Access Policies\n- Require compliant\u002Fmanaged device for sensitive application access\n- Block authentication from anonymous proxies and Tor exit nodes\n- Enforce token binding to limit session cookie replay\n- Configure continuous access evaluation (CAE) for real-time token revocation\n- Implement sign-in risk policies that require re-authentication for risky sign-ins\n\n### Step 3: Build AiTM Detection Rules\n- Alert on sign-in followed by session from different IP within 10 minutes\n- Detect authentication where proxy IP does not match user's expected location\n- Monitor for impossible travel patterns in session usage\n- Alert on inbox rules created immediately after authentication (common post-compromise)\n- Detect new MFA method registration from suspicious sign-in\n\n### Step 4: Monitor Web Proxy for AiTM Infrastructure\n- Log and analyze DNS queries to newly registered domains\n- Detect connections to known PhaaS infrastructure IPs\n- Alert on authentication page backgrounds loaded from legitimate CDNs through proxy domains\n- Monitor for SSL certificates issued to domains mimicking corporate login pages\n- Block access to known EvilProxy\u002FEvilginx infrastructure via threat intelligence\n\n### Step 5: Implement Post-Compromise Detection\n- Alert on mailbox forwarding rules created after suspicious authentication\n- Detect OAuth app consent after AiTM sign-in\n- Monitor for email sending patterns indicating BEC follow-up\n- Alert on SharePoint\u002FOneDrive mass download after session hijack\n- Track lateral movement from compromised account\n\n## Tools & Resources\n- **Microsoft Entra ID Protection**: Risk-based Conditional Access\n- **Azure AD Sign-in Logs**: Authentication event analysis\n- **Okta ThreatInsight**: AiTM proxy detection at IdP level\n- **Sekoia TDR**: AiTM campaign tracking and intelligence\n- **Evilginx (defensive)**: Understanding attack mechanics for detection\n\n## Validation\n- Phishing-resistant MFA blocks AiTM session capture in test scenario\n- Conditional Access denies session replay from different device\u002FIP\n- SIEM alerts fire on simulated AiTM sign-in patterns\n- Web proxy blocks connections to known PhaaS infrastructure\n- Post-compromise rules detect inbox rule creation after suspicious auth\n",{"cwe":44,"name":5,"tags":46,"capec":52,"model":24,"tools":53,"domain":34,"maxTurns":57,"nist_csf":58,"subdomain":63,"description":7,"mitre_attack":64},[45],"CWE-384",[21,47,48,19,49,50,51,26],"evilproxy","evilginx","mfa-bypass","session-hijacking","reverse-proxy",[],[54,33,55,56],"Read","Glob","Grep",20,[59,60,61,62],"PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02","phishing-defense",[65,66,67,68,69],"T1003","T1059","T1550","T1566","T1583.001","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Femail\u002Fphishing\u002Faitm\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill phishing-aitm-detect",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill phishing-aitm-detect",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill phishing-aitm-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Faitm\u002Fdetect\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",649,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Femail\u002Fphishing\u002Faitm\u002Fdetect\u002Findex.json",[98,120,141,162,183,199],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,20,106,107,108,32,37,109,110,111,112,113,114,115,116,117,118,34,119],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,105,128,107,129,130,131,34,33,132,133,134,135,136,32,137,138,29,139,140],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,34,33,154,132,155,156,32,29,157,158,159,160,161,24],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[20,169,170,171,23,172,173,37,174,34,119,175,176,177,178,179,180,181,182,32],"processes token impersonate detect","token","processes","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[190,191,20,192,171,172,193,37,194,174,34,119,132,195,196,197,198,182,32,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":205,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[206,20,171,207,193,37,208,209,34,119,210,211,212,213,214,215,32,109,216,217],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]