Most Important 2026 Detection — Help Desk Ticket / Account-Change Correlation Sp

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•2

This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.