SimpleHelp OIDC MFA Bypass via Technician First-Login Self-Registration
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
Microsoft Sentinel (KQL)
