Detection rules › Sigma
Disabling Multi Factor Authentication
Detects disabling of Multi Factor Authentication.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556.006 Modify Authentication Process: Multi-Factor Authentication |
| Defense Impairment | T1556.006 Modify Authentication Process: Multi-Factor Authentication |
| Credential Access | T1556.006 Modify Authentication Process: Multi-Factor Authentication |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- O365 Disable MFA (Splunk)
Rule body yaml
title: Disabling Multi Factor Authentication
id: 60de9b57-dc4d-48b9-a6a0-b39e0469f876
status: test
description: Detects disabling of Multi Factor Authentication.
references:
- https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/
author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
date: 2023-09-18
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1556.006
logsource:
service: audit
product: m365
detection:
selection:
Operation|contains: 'Disable Strong Authentication.'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Operation|contains: 'Disable Strong Authentication.'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Operation | match |
|