Most Important Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Help-Desk Ticket Immediately Preceding Unverified Identity Change
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
YARA-L
