Top Priority 2026 Detection — Password Reset by Non-Enrolled/Unregistered Admin
Detects instances where an administrative action involving a password reset or MFA configuration (StrongAuthenticationMethod update) is initiated by a user account that lacks the designated Helpdesk or Password Administrator role. This behavior indicates potential unauthorized privilege escalation or credential manipulation by an account not formally assigned to support workflows.
Sigma
