Scattered Spider MFA Factor Manipulation - Okta/Azure AD Bulk Changes
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
Splunk (SPL)
