All Detections

Abnormal Mfa Session Behavior

avatar
Ravi Asakapalli@Ravishankaraskp
updated May 17, 202620218

Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.

YARA-L