DEF CON 34 – Matteo Giordano – Anomalous WebAuthn/Passkey registration pattern (post-ceremony attack surface)
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Microsoft Sentinel (KQL)
