Change to Authentication Method

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.