Sign-in MFA approval via pre-staged PhoneAppOTP method
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
Splunk (SPL)
