MFA Method Registered After Sign-in From Unfamiliar Network (AiTM Persistence)
Detects a new MFA method registration (phone, authenticator or passkey) shortly after the same user signs in to the Security Info pages from an ASN they haven’t used in the past 14 days. Common AiTM pattern: the attacker replays a stolen session cookie, then registers their own MFA method to keep access after the password is reset. Correlates on the sign-in rather than the audit log IP, because “User registered security info” events often record a Microsoft backend IP instead of the attacker’s.
Microsoft Sentinel (KQL)
