Sign-in to My Sign-Ins Security Portal via Compromised Session

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.