Most Important 2026 Detection — Privileged Role Assignment Shortly After Help De
Detects the assignment of high-privileged Entra ID roles to a user account shortly after that same account underwent a password reset or MFA method change initiated by a helpdesk-privileged account. This detection pattern is specifically designed to identify Scattered Spider (UNC3944) tactics where social engineering is used to manipulate helpdesk processes to compromise identities and escalate privileges.
Sigma
