Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

MFA Method Reset/Registration Change (Helpdesk Vishing Indicator)

Falcon Persistence Sentinel
MITRE ATT&CK
Multi-Factor Authentication
Data Source
AuditLogs
Date Added
2026-09-18
Last Updated
2026-09-18
Source
Google Cloud Blog (cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments), SecurityWeek, The Hacker News
What This Detects
Falcon is one of five rebrand aliases of UNC6671 (formerly BlackFile, alongside Redact/Pink/Helix per Google Threat Intelligence). Its crews impersonate IT helpdesk via vishing to employees' personal phones and talk them into an MFA re-enrollment, then harvest credentials/MFA tokens via an AiTM panel. This is not a disk-encryption ransomware - hunt identity logs, not file telemetry.
Query
AuditLogs
| where OperationName has_any ("Update user","Reset password","Add registration","Delete registration","StrongAuthenticationMethod")
| project TimeGenerated, OperationName, InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), TargetResources

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.