Unauthorized VDI/auth portal file modification implementing hard-coded OTP bypass (Gunra)
Detects unauthorized modification of VDI/authentication-portal files implementing a hard-coded OTP-acceptance bypass, a specific Gunra MFA-tampering technique distinguished from routine MFA policy changes.
Microsoft Sentinel (KQL)
