Most Important Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Conditional Access/Auth Policy Modified to Weaken MFA
Detects modifications to Entra ID Conditional Access or Okta authentication policies that introduce MFA exclusions, trusted network bypasses, or authentication-strength downgrades. This activity is highly indicative of an adversary attempting to maintain persistence or bypass MFA following a successful initial account compromise.
YARA-L
