Most Important 2026 Detection — Helpdesk MFA Reset Followed by Immediate New Dev
Detects an MFA authentication method reset or password reset performed against an Entra ID / Azure AD user account, initiated by an account holding a helpdesk/support administrative role (Helpdesk Administrator, Password Administrator, Authentication Administrator, User Administrator). This is stage one of the Scattered Spider / Octo Tempest help-desk-impersonation chain implicated in more than 100 intrusions per the 2025 CISA/FBI joint advisory: an attacker socially engineers a support agent into resetting a target's MFA method or password, then immediately registers a new device or authenticator to complete account takeover. Analyst follow-up: pivot on UserId/TargetUserPrincipalName to check for a device-add/Entra-join event ('Add device', 'Register device', 'Join device to Azure AD', 'Update device') within 30 minutes of this alert for the SAME identity — that sequence confirms a completed takeover and should be escalated to critical.
Sigma
