User Risk and MFA Registration Policy Updated

Status: test
Severity: high
Log source: product azure, service auditlogs
Author: Harjot Singh (@cyb3rjy0t)
Source: github.com/SigmaHQ/sigma

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

Known false positives

Known updates by administrators.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Platform	Record / event type
Azure	Update User Risk and MFA Registration Policy

Rules detecting the same action

These rules filter on the same operation.

Azure MFA Disabled (Panther)
Azure Policy Violation Detected (Panther)
CA Policy Removed by Non Approved Actor (Sigma)
CA Policy Updated by Non Approved Actor (Sigma)
Certificate-Based Authentication Enabled (Sigma)
Changes to Device Registration Policy (Sigma)
Conditional Access - A Conditional Access app exclusion has changed (Kusto)
Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) (Kusto)

Rule body

title: User Risk and MFA Registration Policy Updated
id: d4c7758e-9417-4f2e-9109-6125d66dabef
status: test
description: |
    Detects changes and updates to the user risk and MFA registration policy.
    Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
author: Harjot Singh (@cyb3rjy0t)
date: 2024-08-13
tags:
    - attack.persistence
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        LoggedByService: 'AAD Management UX'
        Category: 'Policy'
        OperationName: 'Update User Risk and MFA Registration Policy'
    condition: selection
falsepositives:
    - Known updates by administrators.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    LoggedByService: 'AAD Management UX'
    Category: 'Policy'
    OperationName: 'Update User Risk and MFA Registration Policy'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`Policy`	`field:"Category" kind:eq value:"Policy"`
`LoggedByService`	eq	`AAD Management UX`	`field:"azure_ad::logged_by_service" kind:eq value:"AAD Management UX"`
`OperationName`	eq	`Update User Risk and MFA Registration Policy`	`field:"OperationName" kind:eq value:"Update User Risk and MFA Registration Policy"`