Risky Sign-in with new MFA method

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query identifies new MFA methods added to an account within 6 hours of a medium or high risk sign-in session. It includes UEBA logs IdentityInfo and BehaviorAnalytics for context.

Attribute Value
Type Hunting Query
Solution Business Email Compromise - Financial Fraud
ID bfacf634-c75e-4291-998c-ecbc0323d943
Tactics Persistence
Techniques T1078.004
Required Connectors AzureActiveDirectory, BehaviorAnalytics, BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AuditLogs ?
BehaviorAnalytics ?
IdentityInfo ?
SigninLogs OperationName == "Update user" ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries · Back to Business Email Compromise - Financial Fraud