Most Popular Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Privileged Account Password/MFA Reset Outside Business Hours
Detects suspicious account management activities, such as password resets or MFA re-enrollment, performed by an operator on a high-privileged or administrator account outside of typical business hours (06:00-20:00). This behavior is often indicative of help-desk impersonation or credential takeover attempts targeting Identity Provider (IdP) administrative roles.
YARA-L
