Elastic high stable kql

Google Workspace MFA Enforcement Disabled For Organization

Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate credential abuse at scale, and reduce friction for follow-on account takeover across the domain.

View Source

Detection Logic

data_stream.dataset:google_workspace.admin
  and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION)
  and google_workspace.admin.new_value:false

False Positives

⚠ MFA policies may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.

Field Validations

Loading…

Comments (0)

Loading comments...