Lion Cipher Lab
Detect an attacker registering their own MFA method (build the detector from scratch)
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When an attacker phishes or buys a password and gets into an account, the clock starts ticking: sooner or later the real user notices, or a risky-sign-in alert fires, and someone resets the password. The attackers who matter plan for that moment in advance. One of the cleanest ways they keep the account is to register THEIR OWN multi-factor method — add their own Microsoft Authenticator app, their own phone number, or their own FIDO security key to the victim's account — often within minutes of the first suspicious sign-in. Now the account has two second factors: the victim's, and the…
What you'll learn
- reading an identity audit event (Microsoft Entra ID style): the 'User registered security info' and 'User deleted security info' activities, and the fields that matter (user, method, IP, country, ASN)
- understanding why registering a NEW authenticator is an account-takeover PERSISTENCE move — it survives the password reset the help desk reaches for
- writing a from-scratch detector in Python's standard library (no pip, no pandas) that learns each user's baseline home ASN/country and flags anomalous MFA registrations
- correlating an MFA registration with a recent risky/foreign sign-in and an old-method deletion, and measuring precision and false-positive rate BEFORE and AFTER the enrichment
- naming why self-service enrollment (new phone, travel) is the honest false positive, and which enrichment cuts it without going blind to the real attack
Steps in this lab
- The attack: registering your own authenticator is persistence
- The only witness: the identity audit log
- Open a terminal and confirm Python works
- Generate a synthetic identity log
- Eyeball the raw stream before you trust any rule
- Write the detector (standard library only)
- Read the before/after and catch the grant
- The honest negative: why self-service enrollment fools you
- The judgment: when this fires falsely, and how a pro hardens it
- Clean up