Detection rules › Panther

Panther rules: mfa

Rule	Severity
MFA Disabled	`high`

MFA Disabled

Severity: high
Log types: Atlassian.Audit, GitHub.Audit, Zendesk.Audit, Okta.SystemLog
Tags: DataModel, Defense Evasion:Modify Authentication Process
Reference: en.wikipedia.org
Source: github.com/panther-labs/panther-analysis

Detects when Multi-Factor Authentication (MFA) is disabled

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Detection logic

import panther_event_type_helpers as event_type


def rule(event):
    return event.udm("event_type") == event_type.MFA_DISABLED


def title(event):
    # use unified data model field in title
    return f"{event.get('p_log_type')}: User [{event.udm('actor_user')}] disabled MFA"

Rule specification

AnalysisType: rule
Filename: mfa_disabled.py
RuleID: "Standard.MFADisabled"
DedupPeriodMinutes: 60
DisplayName: "MFA Disabled"
Enabled: true
LogTypes:
  - Atlassian.Audit
  - GitHub.Audit
  - Zendesk.Audit
  - Okta.SystemLog
Tags:
  - DataModel
  - Defense Evasion:Modify Authentication Process
Reports:
  MITRE ATT&CK:
    - TA0005:T1556
Reference: https://en.wikipedia.org/wiki/Multi-factor_authentication
Severity: High
Description: Detects when Multi-Factor Authentication (MFA) is disabled
SummaryAttributes:
  - p_any_ip_addresses

Stages and Predicates

Fires on Atlassian.Audit, GitHub.Audit, Zendesk.Audit (and 1 more) events when the condition below holds.

Condition

event_type is mfa_disabled

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event_type`	eq	`mfa_disabled`	`field:"event_type" kind:eq value:"mfa_disabled"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field
`p_log_type`
`actor_user`

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "action": "org.disable_two_factor_requirement",
  "actor": "cat",
  "created_at": 1621305118553,
  "org": "my-org",
  "p_log_type": "GitHub.Audit",
  "repository": "my-org/my-repo"
}