Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace (opens in new tab)

Covers Does anyone have experience configuring Token Binding via Conditional Access policy in Entra?Covered by 4 sources including This Week In 4n6, Detection Engineering Weekly

Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship detection rules for both tiers, and contain incidents in under 10 seconds with Elastic Workflows.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 4 articles

This Week In 4n6·

Week 22

Detection Engineering Weekly·

DEW #159 - Synthetic Logs for Detection, Device Code Phishing Detection & Mythos 5 release

BadCyber·

IT Security Weekend Catch Up

View all 4 ›