Actor-Controlled MFA Software Token Registered for Persistence

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects the registration of a new MFA authentication method (software OTP token or authenticator app) on an Azure AD account, specifically when triggered with 'NO_DEVICE' or 'NO_DEVICE_TOKEN' markers and 'SoftwareTokenActivated' tags. This behavior is indicative of potential attacker persistence following account compromise where a new MFA device is added for future access.