SIM Swap Suspected via MFA Phone Method Change and Subsequent Login
Detects when a user's phone authentication method is changed or added, followed shortly by a successful MFA-based sign-in for that same user. This pattern can indicate a SIM swap attack where an adversary socially engineers a helpdesk or convinces a mobile carrier to port a user's number to an adversary-controlled SIM card. This allows the adversary to intercept MFA codes sent via SMS or phone call and gain unauthorized access.
Microsoft Sentinel (KQL)
