Detection rules › Sigma
Change to Authentication Method
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation, T1556 Modify Authentication Process |
| Privilege Escalation | T1098 Account Manipulation |
| Defense Impairment | T1556 Modify Authentication Process |
| Credential Access | T1556 Modify Authentication Process |
Event coverage
| Provider | Event |
|---|---|
| Entra-AuditLogs | User registered security info |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- Authentication Method Changed for Privileged Account (Kusto)
- Authentication Methods Changed for Privileged Account (Kusto)
- Guest Users Invited To Tenant By Non Approved Inviters (Sigma)
- Multi Factor Authentication Disabled For User Account (Sigma)
- New External User Granted Admin Role (Kusto)
- NRT Authentication Methods Changed for VIP Users (Kusto)
- Password Reset By User Account (Sigma)
- Suspicious Login from deleted guest account (Kusto)
Rule body yaml
title: Change to Authentication Method
id: 4d78a000-ab52-4564-88a5-7ab5242b20c7
status: test
description: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-25
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.defense-impairment
- attack.t1556
- attack.persistence
- attack.t1098
logsource:
product: azure
service: auditlogs
detection:
selection:
LoggedByService: 'Authentication Methods'
Category: 'UserManagement'
OperationName: 'User registered security info'
condition: selection
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
LoggedByService: 'Authentication Methods'
Category: 'UserManagement'
OperationName: 'User registered security info'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Category | eq |
|
LoggedByService | eq |
|
OperationName | eq |
|