SSPR Followed by Authenticator App Registration

Ibrahim Saud@tektrix

•updated Jun 18, 2026•4•0•8

Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.