Most Critical ShinyHunters 2026: Vishing-Enabled SSO Credential Harvesting & Rogue MFA Device Enrollment
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Microsoft Sentinel (KQL)
