Dormant User Update MFA and Logs In - UEBA

'This query look for accounts that have not been successfully logged into recently who then add or update an MFA method before logging in. Threat actors may look to re-activate dormant accounts and use them for access by adding MFA methods in the hope that changes to such dormant accounts may go un-noticed. This query uses the Microsoft Sentinel UEBA features. Ref: [LINK TO BLOG]'