Azure Entra ID Sign-In Using Axios User Agent

Flags Azure Entra ID sign-ins with a user agent containing "axios", indicating potential automated sign-in activity.

FreeUnreviewedSigmalowv1

azure-entra-id-sign-in-using-axios-user-agent-ea1a07f0

title: Azure Entra ID Sign-In Using Axios User Agent
id: 5394c458-b9f3-438b-94c9-f3b663cfdfe6
status: experimental
description: This rule flags Azure Entra ID sign-in events where the recorded user agent contains "axios". Attackers can use automated HTTP clients for credential harvesting or phishing workflows, so user-agent based patterns can help highlight suspicious automation. It relies on Azure sign-in log telemetry that includes the sign-in user agent string.
references:
  - https://thehackernews.com/2025/09/axios-abuse-and-salty-2fa-kits-fuel.html
  - https://www.proofpoint.com/us/blog/threat-insight/http-client-tools-exploitation-account-takeover-attacks
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/azure/signin_logs/azure_ad_signin_axios_user_agent.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-04-28
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557
  - detection.threat-hunting
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    userAgent|contains: axios
  condition: selection
falsepositives:
  - Legitimate internal or third-party applications built with Node.js that use Axios as their HTTP client for authenticating against Azure/Entra ID.
level: low
license: DRL-1.1
related:
  - id: ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
    type: derived

What it detects

This rule flags Azure Entra ID sign-in events where the recorded user agent contains "axios". Attackers can use automated HTTP clients for credential harvesting or phishing workflows, so user-agent based patterns can help highlight suspicious automation. It relies on Azure sign-in log telemetry that includes the sign-in user agent string.

Known false positives

Legitimate internal or third-party applications built with Node.js that use Axios as their HTTP client for authenticating against Azure/Entra ID.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.