Most Important ShinyHunters Detection 2026: Rogue External Authentication Method Registration in Entra ID (TrustSink)
Detects additions, updates, or modifications to External Authentication Methods (EAM) or federated identity providers in Microsoft Entra ID. This activity is consistent with the TrustSink technique, where an adversary registers a malicious OIDC MFA provider to facilitate authentication bypass or persistence.
YARA-L
