Detection rules › Sigma
Disabled MFA to Bypass Authentication Mechanisms
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556 Modify Authentication Process |
| Defense Impairment | T1556 Modify Authentication Process |
| Credential Access | T1556 Modify Authentication Process |
Rule body yaml
title: Disabled MFA to Bypass Authentication Mechanisms
id: 7ea78478-a4f9-42a6-9dcd-f861816122bf
status: test
description: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
references:
- https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
author: '@ionsor'
date: 2022-02-08
tags:
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1556
logsource:
product: azure
service: activitylogs
detection:
selection:
eventSource: AzureActiveDirectory
eventName: 'Disable Strong Authentication.'
status: success
condition: selection
falsepositives:
- Authorized modification by administrators
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: AzureActiveDirectory
eventName: 'Disable Strong Authentication.'
status: success
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
eventSource | eq |
|
status | eq |
|