New Device Registered for MFA Bypass Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.