VPN Logon Success Without MFA Challenge (Rhysida-style Credential Abuse)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects successful VPN authentication events where no multi-factor authentication (MFA) method is reported in the logs. This behavior may indicate an account compromise where an adversary has bypassed MFA or is using a legacy account that lacks MFA enforcement.