Sefa G
@chmod7770 followers0 downloads8 copies0 likes16 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
Detects a new MFA method registration (phone, authenticator or passkey) shortly after the same user signs in to the Security Info pages from an ASN they haven’t used in the past 14 days. Common AiTM pattern: the attacker replays a stolen session cookie, then registers their own MFA method to keep access after the password is reset. Correlates on the sign-in rather than the audit log IP, because “User registered security info” events often record a Microsoft backend IP instead of the attacker’s.
