Modify Authentication Process: Multi-Factor Authentication T1556.006

Tactics: Defense Impairment, Persistence, Credential Access

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Authoring guide

Patterns shared across the 33 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (51 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
data_stream.dataset11eq 11okta.system, aws.cloudtrail, azure.auditlogs, azure.signinlogs, google_workspace.admin
EventType8eq 6, in 2AssumeRole, AssumeRoleWithSAML, AssumeRoleWithWebIdentity, CreateVirtualMFADevice, DeactivateMFADevice
sourcetype8eq 8aws:asl, aws:cloudtrail, azure:monitor:aad, OktaIM2:log, gws:reports:admin
EventID5eq 4, in 124, 4723, 4724, CreateVirtualMFADevice, DeactivateMFADevice
Provider_Name4eq 4iam.amazonaws.com, admin, sts.amazonaws.com
aws::eventName4eq 4CreateVirtualMFADevice, DeactivateMFADevice, DeleteVirtualMFADevice
event.outcome4eq 3, in 1success, Success
"result.message"3contains 1, in 1, starts_with 1device paired, *Action: Allowed*, *Action: Approve*, *Action: Authenticate*
operationName3eq 2, contains 1Disable Strong Authentication, User registered security info, set domain authentication, set federation settings on domain
category2eq 2AuditLogs
event.category2eq 2authentication, iam
okta::eventType2eq 2, in 1, wildcard 1user.authentication*, user.mfa.factor.activate, user.mfa.factor.deactivate, user.mfa.factor.reset_all, user.mfa.factor.update
security_result.action2eq 2ALLOW
"resources{}.ipaddress"1eq 1*
"result.status"1eq 1, in 1FAIL*, POLICY, SUCCESS*

Top indicator values (106 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
data_stream.dataseteq
okta.system
548
data_stream.dataseteq
aws.cloudtrail
3141
event.outcomeeq
success
3251
Provider_Nameeq
iam.amazonaws.com
225
aws::eventNameeq
CreateVirtualMFADevice
22
aws::eventNameeq
DeactivateMFADevice
22
aws::eventNameeq
DeleteVirtualMFADevice
22
categoryeq
AuditLogs
26
security_result.actioneq
ALLOW
2102
sourcetypeeq
aws:asl
227
sourcetypeeq
aws:cloudtrail
259
sourcetypeeq
azure:monitor:aad
247
"resources{}.ipaddress"eq
*
1
"result.message"contains
device paired
1
"result.message"in
*Action: Allowed*
1
"result.message"in
*Action: Approve*
1
"result.message"in
*Action: Authenticate*
1
"result.message"starts_with
device paired
1
"result.status"eq
POLICY
1
"result.status"in
FAIL*
1
"result.status"in
SUCCESS*
1
"result.status"in
UNSUCCESSFUL*
1
All_Changes.actioneq
modified
13
All_Changes.commandeq
user.mfa.factor.deactivate
1
All_Changes.object_categoryeq
User
12
AwsSecurityFindingGeneratorIdeq
security-control/IAM.9
1
Categoryeq
UserManagement
111
ComplianceSecurityControlIdeq
IAM.9
1
ComplianceStatuseq
FAILED
18
EventIDeq
24
1

Exclusions (7 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
"result.message"in
*create*
1
"result.message"in
*delete*
1
"result.message"in
*pair*
1
azure_ad::authentication_requirementeq
multiFactorAuthentication
1
data_stream.dataseteq
okta.system
1
okta::eventTypeeq
user.mfa.factor.activate
1
source.as.organization.nameeq
MICROSOFT-CORP-MSN-AS-BLOCK
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 11 rules

Splunk 11 rules

Kusto 2 rules

YARA-L 4 rules

Panther 2 rules