Storm-3121/3032 Software OTP Enrollment with Placeholder Device Token

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects when a user identity in Azure AD has a new software OTP token activated, specifically marked with property flags indicating a placeholder or new device enrollment. This behavior can be indicative of an adversary registering a new, attacker-controlled MFA device to maintain persistent access to a compromised account.