AWS Multi-Factor Authentication Disabled

Status: production
Severity: medium
Group by: aws::awsRegion, aws::recipientAccountId, aws::userAgent, dest, signature, src, user, vendor_product
Author: Bhavin Patel, Splunk
Source: github.com/splunk/security_content

The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages AWS CloudTrail logs to identify events where MFA devices are deleted or deactivated. This activity is significant because disabling MFA can indicate an adversary attempting to weaken account security, potentially to maintain persistence using a compromised account. If confirmed malicious, this action could allow attackers to retain access to the AWS environment without detection, posing a significant risk to the security and integrity of the cloud infrastructure.

Known false positives

AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1586.003` Compromise Accounts: Cloud Accounts
Persistence	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Defense Impairment	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Credential Access	`T1556.006` Modify Authentication Process: Multi-Factor Authentication `T1621` Multi-Factor Authentication Request Generation

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeactivateMFADevice`: Deactivates an MFA device previously associated with an IAM user, removing the MFA requirement for that user.
AWS	CloudTrail event `DeleteVirtualMFADevice`: Deletes a virtual MFA device, permanently removing it from the account.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS Multi-Factor Authentication Disabled (Splunk)
Multi-Factor Authentication Disabled for a User (Kusto)

Rule body

name: AWS Multi-Factor Authentication Disabled
id: 374832b1-3603-420c-b456-b373e24d34c0
version: 12
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects attempts to disable multi-factor authentication (MFA) for an AWS IAM user. It leverages AWS CloudTrail logs to identify events where MFA devices are deleted or deactivated. This activity is significant because disabling MFA can indicate an adversary attempting to weaken account security, potentially to maintain persistence using a compromised account. If confirmed malicious, this action could allow attackers to retain access to the AWS environment without detection, posing a significant risk to the security and integrity of the cloud infrastructure.
data_source:
    - AWS CloudTrail DeleteVirtualMFADevice
    - AWS CloudTrail DeactivateMFADevice
search: |-
    `cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice)
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_multi_factor_authentication_disabled_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://aws.amazon.com/what-is/mfa/
finding:
    title: User $user$ has disabled Multi-Factor authentication for AWS account $vendor_account$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1556.006
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

Stages and Predicates

Stage 1: `search`

`cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice)

Stage 2: `rename`

| rename user_name as user

Stage 3: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product

Stage 4: `search`

| `security_content_ctime(firstTime)`

Stage 5: `search`

| `security_content_ctime(lastTime)`

Stage 6: `search`

| `aws_multi_factor_authentication_disabled_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeactivateMFADevice` `DeleteVirtualMFADevice`	`field:"aws::eventName" kind:eq`
`sourcetype`	eq	`aws:cloudtrail`	`field:"sourcetype" kind:eq value:"aws:cloudtrail"`