Post-AiTM Account Persistence: New MFA/OAuth Grant/Mailbox Rule

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects high-risk administrative actions in Microsoft 365, such as new MFA method registration, OAuth app consent grants, or email forwarding rule creation, occurring in sessions that lack fresh authentication (often indicative of a session-cookie replay attack).