Sigma medium test sigma

Multi Factor Authentication Disabled For User Account

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

View Source

Detection Logic

{
  "selection": {
    "LoggedByService": "Core Directory",
    "Category": "UserManagement",
    "OperationName": "Update user",
    "TargetResources.ModifiedProperties.DisplayName": "StrongAuthenticationRequirement",
    "TargetResources.ModifiedProperties.NewValue
| contains": "State\":0"
  },
  "condition": "selection"
}

False Positives

⚠ Legitimate authorized activity.

Field Validations

Loading…

Comments (0)

Loading comments...