UNC6671-style Vishing / AiTM / SaaS Exfiltration
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Microsoft Sentinel (KQL)
