MFA/Passkey Re-Registration on Executive Accounts After Support Contact

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects modifications or additions to Multi-Factor Authentication (MFA) security information for high-value users, specifically targeting those with executive titles (Director, VP, President, etc.). This behavior is frequently associated with account takeover attempts where an attacker registers their own MFA device to a compromised privileged account to maintain persistence.