Agent Foskett Investigation • Identity Compromise • MFA Registration • Microsoft Entra ID • Defender XDR • KQL
The New MFA Method Was Registered 11 Minutes After the Login
The sign-in was successful.
The password worked. MFA was satisfied. Nothing in the first few minutes looked dramatic.
Eleven minutes later, the account registered a new authentication method.
That second event changed the meaning of the first.
Agent Foskett stopped treating them as separate records and started building a timeline.
Identity Compromise Investigation
The sign-in looked ordinary. The timeline did not.
Correlate sign-ins with authentication changes
Inspect MFA method registration and audit activity
Build the identity timeline before deciding what happened
The first event did not look like a compromise
A successful sign-in is not proof that the person behind it was legitimate. The investigation changed when an authentication method was registered only eleven minutes later.
Successful authenticationThe account completed the sign-in flow, so there was no failed-login pattern to attract immediate attention.
Eleven-minute gapA new authentication method appeared shortly after the sign-in, creating a sequence worth investigating.
Persistence through identityIf an attacker can add an authentication method, future access may no longer depend on the victim approving MFA.
The timeline changed the investigation
Agent Foskett placed the events next to each other instead of reviewing them in separate portals.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
02:03 Successful sign-in 02:07 New session activity 02:14 Authentication method registered 02:16 Account signs in again Question: Who controlled the account at 02:14?
Start with the sign-in evidence
In Microsoft Defender XDR, begin with the identity activity available in your tenant. Table coverage and action names can vary, so inspect the returned fields before narrowing the hunt.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
IdentityLogonEvents
| where Timestamp > ago(7d)
| where AccountUpn =~ "alex.morgan@contoso.com"
| project Timestamp, AccountUpn, ActionType,
Application, IPAddress, Location, DeviceName
| order by Timestamp ascLook for authentication-method changes
Authentication-method registration is recorded through Microsoft Entra audit activity. In Sentinel, Entra audit logs are commonly queried through AuditLogs. Start broadly because operation names and target-resource details can vary.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
AuditLogs
| where TimeGenerated > ago(7d)
| where Category =~ "UserManagement"
| where OperationName has_any ("authentication method", "security info")
| where tostring(TargetResources) has "alex.morgan@contoso.com"
| project TimeGenerated, OperationName, Result,
InitiatedBy, TargetResources, AdditionalDetails
| order by TimeGenerated ascDiscover the exact operations in your tenant
Do not assume one operation string will exist everywhere. First enumerate relevant audit operations, then use the values your environment actually records.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
AuditLogs
| where TimeGenerated > ago(30d)
| where Category =~ "UserManagement"
| where OperationName has_any ("authentication", "security info", "MFA")
| summarize Events = count() by OperationName
| order by Events descNow compare what happened before and after registration
The registration event matters most when it sits inside a suspicious sequence. Compare IP addresses, locations, applications, devices and subsequent authentication activity around the same account.
Was the device expected?A familiar username does not make an unfamiliar device legitimate.
Did the IP or location change?Compare the sign-in immediately before registration with activity immediately after it.
What happened next?Search for mailbox access, privilege changes, cloud activity and further sign-ins after the new method appeared.
Agent Foskett's investigation mindset
A successful sign-in and an MFA registration are ordinary events in isolation. Timing and context can turn them into evidence.
Do not stop at “MFA succeeded”MFA tells you an authentication requirement was satisfied. It does not, by itself, establish who controlled the session.
Correlate configuration changesAuthentication-method changes deserve extra attention when they follow an unusual or newly established session.
Build chronology firstEstablish what happened and when before deciding whether the activity was legitimate, malicious or inconclusive.
Investigation findings
The important clue was not a failed sign-in. It was the relationship between a successful sign-in and a security change eleven minutes later.
The sign-in succeededNothing about success alone proved that the session belonged to the legitimate user.
The new method was the pivotRegistration eleven minutes later created the strongest reason to examine the earlier session again.
The timeline connected the evidenceSign-in and audit evidence became meaningful when reviewed as one identity-compromise sequence.
Related Agent Foskett investigations
Continue with data movement, cloud activity, insider risk and endpoint investigations.
The User Downloaded 4GB of Data Before ResigningInvestigate abnormal SharePoint and OneDrive volume before an employee departure.
The User Shared The File With EveryoneInvestigate excessive sharing and risky access to cloud-hosted data.
The USB Drive Was Never Meant To Be FoundInvestigate removable media as another possible data movement path.
The Browser Uploaded The File At 2:17AMFollow endpoint and browser evidence when data leaves through a web session.
KQL Threat Hunting GuideBuild practical hunting queries for Microsoft security investigations.
Agent Foskett AcademyBuild practical KQL and Microsoft security investigation skills through structured lessons.
Final thought
Attackers do not always need to defeat MFA. Sometimes they only need one successful session long enough to change what MFA means for the account.
The login was only the beginningThe most important evidence appeared after authentication had already succeeded.
Eleven minutes matteredShort gaps between authentication and security-information changes deserve investigation, not assumption.
Identity is a timelineSign-ins, MFA changes, privilege events and cloud activity should be investigated together.
