Suspicious MFA Authentication Method Registration for Persistence

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•4

Detects successful modifications to user MFA methods (StrongAuthenticationMethod) where the associated device details are missing or indicate a software-only token activation. This behavior is often indicative of an adversary adding their own MFA device to a compromised account to maintain persistent access or bypass MFA requirements.