New MFA/authentication method registered for persistence

Ibrahim Saud@tektrix

•updated Sep 16, 2026•5•0•6

Detects modifications to a user account's authentication methods, specifically when an increase in the number of configured multi-factor authentication (MFA) devices or methods occurs. This is often associated with an adversary enrolling their own device to bypass MFA or maintain persistent access.