Unusual FIDO Key Registration
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
Sigma
