NRT GitHub Two Factor Auth Disable

Severity: medium
Source: github.com/Azure/Azure-Sentinel

Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `org.disable_two_factor_requirement`: 2FA requirement disabled for organization

Rules detecting the same action

These rules filter on the same operation.

GitHub Enterprise Disable 2FA Requirement (Splunk)
Github High Risk Configuration Disabled (Sigma)
GitHub Org Authentication Method Changed (Panther)
GitHub Organizations Disable 2FA Requirement (Splunk)
GitHub Two Factor Auth Disable (Kusto)
GitHub Two-Factor Authentication Requirement Disabled (YARA-L)

Rule body

id: 594c653d-719a-4c23-b028-36e3413e632e
name: NRT GitHub Two Factor Auth Disable
description: |
  'Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected. '
severity: Medium
requiredDataConnectors: []
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  GitHubAuditData
  | where Action == "org.disable_two_factor_requirement"
  | project TimeGenerated, Action, Actor, Country, Repository
  | extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
  | extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
version: 1.0.3
kind: NRT

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "org.disable_two_factor_requirement"

Stage 3: `project`

| project TimeGenerated, Action, Actor, Country, Repository

Stage 4: `extend`

| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)

Stage 5: `extend`

| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`org.disable_two_factor_requirement`	`field:"Action" kind:eq value:"org.disable_two_factor_requirement"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`Actor`	`project`
`Country`	`project`
`Repository`	`project`
`TimeGenerated`	`project`
`Name`	`extend`
`UPNSuffix`	`extend`