VPN Logon with Valid Credentials Absent MFA - Anomalous Source

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.