Okta Multi-Factor Authentication Disabled

Status: production
Severity: medium
Group by: All_Changes.command, All_Changes.dest, All_Changes.result, All_Changes.src, All_Changes.user, sourcetype
Author: Mauricio Velazco, Splunk
Source: github.com/splunk/security_content

The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised valid account. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network.

Known false positives

Legitimate use case may require for users to disable MFA. Filter lightly and monitor for any unusual activity.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Defense Impairment	`T1556.006` Modify Authentication Process: Multi-Factor Authentication
Credential Access	`T1556.006` Modify Authentication Process: Multi-Factor Authentication

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.mfa.factor.deactivate`: MFA factor deactivated for user

Rules detecting the same action

These rules filter on the same operation.

MFA Deactivation with no Re-Activation for Okta User Account (Elastic)
New Device/Location sign-in along with critical operation (Kusto)
Okta Investigate MFA and Password resets (Panther)
Okta MFA Reset or Deactivated (Sigma)
Okta User Password and MFA Factor Reset or Deactivated (YARA-L)

Rule body

name: Okta Multi-Factor Authentication Disabled
id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
version: 13
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies an attempt to disable multi-factor authentication (MFA) for an Okta user. It leverages OktaIM2 logs to detect when the 'user.mfa.factor.deactivate' command is executed. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised valid account. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network.
data_source:
    - Okta
search: |-
    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
      WHERE sourcetype="OktaIM2:log" All_Changes.object_category=User
        AND
        All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate
      BY All_Changes.user All_Changes.result All_Changes.command
         sourcetype All_Changes.src All_Changes.dest
    | `drop_dm_object_name("All_Changes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `okta_multi_factor_authentication_disabled_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Legitimate use case may require for users to disable MFA. Filter lightly and monitor for any unusual activity.
references:
    - https://attack.mitre.org/techniques/T1556/
    - https://splunkbase.splunk.com/app/6553
finding:
    title: MFA was disabled for User [$user$] initiated by [$src$]. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1556.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

Stages and Predicates

Stage 1: `tstats`

| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
  WHERE sourcetype="OktaIM2:log" All_Changes.object_category=User
    AND
    All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate
  BY All_Changes.user All_Changes.result All_Changes.command
     sourcetype All_Changes.src All_Changes.dest

Stage 2: `search`

| `drop_dm_object_name("All_Changes")`

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `okta_multi_factor_authentication_disabled_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`All_Changes.action`	eq	`modified`	`field:"All_Changes.action" kind:eq value:"modified"`
`All_Changes.command`	eq	`"user.mfa.factor.deactivate"`	`field:"All_Changes.command" kind:eq`
`All_Changes.object_category`	eq	`User`	`field:"All_Changes.object_category" kind:eq value:"User"`
`sourcetype`	eq	`"OktaIM2:log"`	`field:"sourcetype" kind:eq`