Detection rules › Sigma
CA Policy Updated by Non Approved Actor
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556 Modify Authentication Process |
| Privilege Escalation | T1548 Abuse Elevation Control Mechanism |
| Defense Impairment | T1556 Modify Authentication Process |
| Credential Access | T1556 Modify Authentication Process |
Rule body yaml
title: CA Policy Updated by Non Approved Actor
id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
status: test
description: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
author: Corissa Koopmans, '@corissalea'
date: 2022-07-19
modified: 2024-05-28
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1548
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Update conditional access policy
condition: selection
falsepositives:
- Misconfigured role permissions
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
properties.message: Update conditional access policy
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
properties.message | eq |
|