We are a managed IT company and AiTM phishes (the ones that reverse proxy the true sign in page and steal session cookies) have been everywhere. We've started experimenting with User-Risk and Sign-In risk policies, and what I thought we had set up made sense to me, but I was doing some more indepth testing and found that what I set up has been basically useless/harmful?
We have the basic conditional access environment:
MFA: MFA enforced for every sign in
Sign-In Risk: MFA Enforced for Risk Signing with Session Control "Every Time" for all levels of sign-in risk
User-Risk: Require password change for Medium/High Risk
My understanding was that particularly, the sign in risk policy, would apply an "Every Time" control to the session cookie, that way when it was stolen via a reverse-proxy, and re-imported to their browser it would request them to sign in again, because in my mind every time their session is reevaluated it should ask them to sign in. This document says to use this control when I want to reauthenticate everytime, which is what I want to have happen when the session has risk.
Issue is it looks like it doing in my environement instead:
- User signs in to reverse proxy link that was sent to them in a phish
- Microsoft sees that there is sign in risk, processes the Sign-In Risk conditional access policy
- Requires Grant Controls "MFA"
- Bad actor at this point would be given this authentication cookie
- Microsoft marks the Sign-in and its associated risk as Remediated because the user "passed mfa".
- Bad actor imports the session cookie to their browser
- Bad actor signs in fine and goes about their day ruining everyone elses
- These subsequent sign ins do not show up as "risky" because the risk associated with it was "remediated" -- which is talked about here
All I am trying to do is impose stringent session controls on these AiTM/reverse-proxy phishing and now I worry that I have been doing more harm than good because I basically set it to "remediate" the risk the very second it occurred.
Any help in pointing me in the right direction is greatly appreciated.
