Best Detection of 2026 Series: Scattered Spider Help-Desk Vishing MFA Reset and New Factor Enrollment
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
YARA-L
