detection.wiki

Detection rules › Panther

OneLogin Authentication Factor Removed

Severity
low
Group by
user_name
Log types
OneLogin.Events
Tags
OneLogin, Identity & Access Management, Defense Evasion:Modify Authentication Process
Reference
https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010426
Source
github.com/panther-labs/panther-analysis

A user removed an authentication factor or otp device.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1556 Modify Authentication Process
Defense ImpairmentT1556 Modify Authentication Process
Credential AccessT1556 Modify Authentication Process

Rule body yaml

AnalysisType: rule
Filename: onelogin_remove_authentication_factor.py
RuleID: "OneLogin.AuthFactorRemoved"
DisplayName: "OneLogin Authentication Factor Removed"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Identity & Access Management
  - Defense Evasion:Modify Authentication Process
Reports:
  MITRE ATT&CK:
    - TA0005:T1556
Severity: Low
Description: >
  A user removed an authentication factor or otp device.
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010426
Runbook: >
  Investigate whether this was an intentional action and if other multifactor devices exist.
SummaryAttributes:
  - account_id
  - event_type_id
  - user_name
  - user_id
  - authentication_factor_description
  - otp_device_name
Tests:
  - Name: User removed an auth factor
    LogType: OneLogin.Events
    ExpectedResult: true
    Log:
      {
        "event_type_id": "172",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "authentication_factor_description": "2FA Name",
      }
  - Name: User deactivated an otp deice
    LogType: OneLogin.Events
    ExpectedResult: true
    Log:
      {
        "event_type_id": "24",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "otp_device_name": "2FA Name",
      }

Detection logic

Condition

event_type_id eq "24" or event_type_id eq "172"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
event_type_ideq
  • 172
  • 24

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
user_name
authentication_factor_description
otp_device_name