Self-Service Password Reset Initiated Outside Normal Support Context

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•7

Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.