New MFA Method Registered from a Never-Before-Seen ASN for that User

Ankit Mehta@Secvyn

•updated Aug 7, 2026•5•0•3

This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.