Attacker-controlled MFA phone/software token registered for persistence

Ibrahim Saud@tektrix

•updated Sep 18, 2026•3•0•4

This rule monitors for updates to a user's multi-factor authentication (MFA) configuration, specifically detecting when a new device is registered or activated. Attackers often register their own devices as MFA second factors to maintain persistent access to a compromised user account.