Microsoft 365 auth method registered
A multi-factor authentication method / security info was registered or changed for an account.
What it detects
A multi-factor authentication method / security info was registered or changed for an account. After stealing a password, attackers register THEIR OWN authenticator, phone, or security key so they can satisfy MFA themselves — a durable persistence move that survives a password reset and locks the real user out of their own second factor.
MITRE ATT&CK mapping
False positives and triage
Users legitimately register MFA at onboarding or when changing phones. The signal is a registration from an unfamiliar IP, for an account with other suspicious activity (a preceding password spray / risky sign-in), or an ADMIN registering a method on someone else's account. Confirm the user made the change.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_auth_method_registered.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_auth_method_registered
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1556.006, T1098]
description: |
A multi-factor authentication method / security info was registered or changed
for an account. After stealing a password, attackers register THEIR OWN
authenticator, phone, or security key so they can satisfy MFA themselves — a
durable persistence move that survives a password reset and locks the real user
out of their own second factor.
match:
provider_any: [Office365, AzureAD]
raw_message_contains_any:
- "registered security info"
- "security info registration"
- "Register security info"
- "changed default security info"
- "StrongAuthenticationMethod"
- "StrongAuthenticationPhoneAppDetail"
correlation_keys: [user_name]
false_positive_guidance: |
Users legitimately register MFA at onboarding or when changing phones. The signal
is a registration from an unfamiliar IP, for an account with other suspicious
activity (a preceding password spray / risky sign-in), or an ADMIN registering a
method on someone else's account. Confirm the user made the change.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.