Authentication Methods Removed Immediately After Password Reset

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•4

Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.