Legacy Authentication Used after Modern MFA Completion

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•5

Detects IMAP, POP, SMTP AUTH, or other legacy authentication activity soon after the same account completes modern MFA. This could indicate an adversary bypassing MFA by using legacy protocols after successfully authenticating with modern MFA.