Anvilogic high experimental spl
Auth0: MFA Device Unenrolled [splunk-auth0]
Threat actors may remove existing MFA devices to disable multi-factor authentication and weaken account security, allowing for easier future access. This use case detects the unenrollment of an MFA device, which could indicate an attacker attempting to bypass MFA protections after compromising an account.
Detection Logic
`get_authentication_data_auth0` "gd_unenroll"
OR "Device used for second factor authentication has been unenrolled"
| where event_type="gd_unenroll"
| table _time, host, user, signature, City, Region, Country, src_ip, coi_user
| bin span=1s
| stats values(*) as * by _time, src_ipField Validations
Loading…
Comments (0)
Loading comments...