Most Popular ShinyHunters 2026 Detection: Helpdesk-Themed Vishing Precursor - MFA Reset Immediately Preceded by IT Support Call Ticket
Detects high-privilege account management actions in Entra ID (password resets or MFA modifications) performed by service or admin accounts, which are characteristic of social engineering (vishing) attacks targeting IT helpdesks to gain unauthorized access.
Sigma
