2026 Critical Enterprise Intrusion Chain Detection: MFA Method Registration Anomaly Post-Compromise
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
Microsoft Sentinel (KQL)
