Change to Authentication Method

Status: test
Severity: medium
Log source: product azure, service auditlogs
Author: AlertIQ
Source: github.com/SigmaHQ/sigma

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation `T1556` Modify Authentication Process
Privilege Escalation	`T1098` Account Manipulation
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
Azure	User registered security info

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Change to Authentication Method
id: 4d78a000-ab52-4564-88a5-7ab5242b20c7
status: test
description: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1556
    - attack.persistence
    - attack.t1098
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        LoggedByService: 'Authentication Methods'
        Category: 'UserManagement'
        OperationName: 'User registered security info'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    LoggedByService: 'Authentication Methods'
    Category: 'UserManagement'
    OperationName: 'User registered security info'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`UserManagement`	`field:"Category" kind:eq value:"UserManagement"`
`LoggedByService`	eq	`Authentication Methods`	`field:"azure_ad::logged_by_service" kind:eq value:"Authentication Methods"`
`OperationName`	eq	`User registered security info`	`field:"OperationName" kind:eq value:"User registered security info"`