Storm-0501 Account Takeover via Synced Password Reset and MFA Registration
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
Microsoft Sentinel (KQL)
