Storm-2755 - MFA Registration during HR Access

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•9

Detects MFA device registration occurring during a suspicious session heavily focused on HR portal access. This rule correlates MFA registration events with access to HR applications like Workday or ADP within a 10-minute window, indicating potential account takeover or unauthorized access attempts.