Suspicious Authentication Device Change with MFA

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•4

This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.