Sign-in via rogue external MFA provider with hardcoded acr/amr claims

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects successful sign-in events where Multi-Factor Authentication (MFA) was satisfied using an 'External Authentication Method' that reports specific claim identifiers ('possessionorinherence' or 'hwk'). This pattern is indicative of the TrustSink rogue-EAM (External Authentication Method) technique, where an attacker exploits custom MFA providers to forge MFA success assertions, effectively bypassing legitimate hardware-key requirements.