SSPR Followed by Authentication Method Deletion

Ibrahim Saud@tektrix

•updated Jun 18, 2026•5•0•9

Detects Self-Service Password Reset (SSPR) activity followed by the deletion of authentication methods within a 1-hour window. This sequence of events can indicate an attacker attempting to maintain access or bypass multi-factor authentication after gaining initial access to an account, potentially executed by threat groups like Storm-2949.