O365 User Agent Detections

[Lipshitz]

I have seen security people talking about finding "axios", "BAV2ROPC", "homeoffice" and other UAs in logs to detect malicious activity. Anybody using might want to rotate headers in kit or copy the client headers.

Here's an article explaining the detections:

https://fieldeffect.com/blog/field-effect-discovers-m365-adversary-in-the-middle-campaign

EDIT: I put wrong url originally