Password reset email followed by non-SSO app password change from same session
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
Microsoft Sentinel (KQL)
