Most Popular Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Help-Desk MFA/Credential Reset on Executive/VIP Account
Detects instances where an account assigned a help-desk or support role performs an MFA, password, or credential reset on an account tagged as an executive or VIP. This behavior is indicative of social engineering and help-desk impersonation attacks commonly utilized by threat actors to perform rogue MFA takeovers.
YARA-L
