Multiple Device Logins with Windows Hello for Business

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.