Detection rules › Kusto
Keeper Security - User MFA Changed
'Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556 Modify Authentication Process |
Rule body kusto
id: 75ffc8a4-86db-4f48-8506-cb4c049be484
name: Keeper Security - User MFA Changed
description: |
'Creates an informational incident based on Keeper Security User MFA Changed data in Microsoft Sentinel'
severity: Informational
status: Available
requiredDataConnectors:
- connectorId: KeeperSecurityPush2
dataTypes:
- KeeperSecurityEventNewLogs_CL
suppressionDuration: PT5H
eventGroupingSettings:
aggregationKind: AlertPerResult
suppressionEnabled: false
tactics:
- Persistence
relevantTechniques:
- T1556
query: |
KeeperSecurityEventNewLogs_CL
| where AuditEvent in (```set_two_factor_off```, ```set_two_factor_on```)
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: false
reopenClosedIncident: false
lookbackDuration: PT5H
matchingMethod: AllEntities
alertDetailsOverride:
alertDisplayNameFormat: "{{AuditEvent}} on {{RemoteAddress}}"
alertDescriptionFormat: "{{AuditEvent}} has been captured in the Keeper Security Event Logs"
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: Username
- entityType: IP
fieldMappings:
- identifier: Address
columnName: RemoteAddress
version: 1.0.3
kind: NRT
Stages and Predicates
Stage 1: source
KeeperSecurityEventNewLogs_CL
Stage 2: where
| where AuditEvent in (```set_two_factor_off```, ```set_two_factor_on```)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AuditEvent | in |
|