Elastic medium stable kql

Entra ID MFA Disabled for User

Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account.

View Source

Detection Logic

data_stream.dataset: "azure.auditlogs" and
    (azure.auditlogs.operation_name: "Disable Strong Authentication" or
    (
        azure.auditlogs.operation_name: "User deleted security info" and
        azure.auditlogs.properties.additional_details.key: "AuthenticationMethod"
    )) and event.outcome: (Success or success)

Field Validations

Loading…

Comments (0)

Loading comments...