Rogue MFA Registration from Untrusted IP

Ibrahim Saud@tektrix

•updated Jun 22, 2026•5•0•9

This rule detects attempts to register a new Authenticator app or phone number for multi-factor authentication (MFA) from an IP address that is not typically associated with the user's sign-in behavior. This could indicate a compromised account where an attacker is attempting to establish a new MFA method to maintain access.