1Password - Disable MFA factor or type for all user accounts

Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

This will alert when the MFA factor or type for all user accounts are disabled. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
1Password	account-disblmfa: Disable Multi-Factor Authentication For All Users

Rule body

id: 92ab0938-1e7c-4671-9810-392e8b9714da
name: 1Password - Disable MFA factor or type for all user accounts
version: 1.0.0
kind: Scheduled
description: |-
  This will alert when the MFA factor or type for all user accounts are disabled. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/
severity: High
requiredDataConnectors:
  - connectorId: 1Password
    dataTypes:
      - OnePasswordEventLogs_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1556
query: |-
  OnePasswordEventLogs_CL
  | where log_source == "auditevents"
  | where action == "disblmfa"
  | where object_type == "account"
  | extend
      ActorUsername = actor_details.email
      , SrcIpAddr = session.ip
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUsername
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr

Stages and Predicates

Stage 1: `source`

OnePasswordEventLogs_CL

Stage 2: `where`

| where log_source == "auditevents"

Stage 3: `where`

| where action == "disblmfa"

Stage 4: `where`

| where object_type == "account"

Stage 5: `extend`

| extend
    ActorUsername = actor_details.email
    , SrcIpAddr = session.ip

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`disblmfa`	`field:"action" kind:eq value:"disblmfa"`
`log_source`	eq	`auditevents`	`field:"log_source" kind:eq value:"auditevents"`
`object_type`	eq	`account`	`field:"object_type" kind:eq value:"account"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorUsername`	`extend`
`SrcIpAddr`	`extend`