AWS New MFA Method Registered For User

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•50

Detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS user. This can be an indicator of an attacker attempting to maintain persistence or bypass existing MFA controls by registering their own MFA device.