Splunk unknown stable spl

GCP Multi-Factor Authentication Disabled

The following analytic detects an attempt to disable multi-factor authentication (MFA) for a Google Cloud Platform (GCP) user. It leverages Google Workspace Admin log events, specifically the `UNENROLL_USER_FROM_STRONG_AUTH` command. This activity is significant because disabling MFA can allow an adversary to maintain persistence within the environment using a compromised account without raising suspicion. If confirmed malicious, this action could enable attackers to bypass additional security layers, potentially leading to unauthorized access, data exfiltration, or further exploitation of the compromised account.

View Source

Detection Logic

`gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH
| stats count min(_time) as firstTime max(_time) as lastTime
    BY user, command, actor.email,
       status, id.applicationName, event.name,
       vendor_account, action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `gcp_multi_factor_authentication_disabled_filter`

False Positives

  • ⚠ Legitimate use case may require for users to disable MFA. Filter as needed.

Field Validations

Loading…

Comments (0)

Loading comments...