Suspicious sign-in followed by attacker MFA method registration

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

Detects instances where a user account experiences an 'Unusual sign-in' event followed by the registration of a new MFA or security information method within a one-hour window. This behavior is indicative of an attacker attempting to establish persistent access by registering their own authentication device to a compromised account.