Azure AD User Registered Security Info

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.