Rogue EAM credential recapture after password reset

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects user sign-ins that utilize an 'External Authentication Method' within 3 days of a password reset event. This behavior may indicate an adversary has successfully established persistence using a rogue authentication provider (e.g., via a TrustSink or similar malicious configuration) that survives password remediation and is capable of capturing or intercepting subsequent authentication tokens.