{"id":"7ea78478-a4f9-42a6-9dcd-f861816122bf","title":"Disabled MFA to Bypass Authentication Mechanisms","description":"Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.","author":"@ionsor","status":"test","level":"medium","date":"2022-02-08","modified":"","tags":["attack.credential-access","attack.persistence","attack.defense-impairment","attack.t1556"],"technique_ids":["T1556"],"logsource":{"product":"azure","service":"activitylogs"},"falsepositives":["Authorized modification by administrators"],"references":["https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates"],"source_path":"rules/cloud/azure/activity_logs/azure_mfa_disabled.yml","source_sha256":"eba9a7eefe54f4509de6cb6f14db7abd6b583a78e72c26e733bc17935b8656e7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_mfa_disabled.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disabled MFA to Bypass Authentication Mechanisms\nid: 7ea78478-a4f9-42a6-9dcd-f861816122bf\nstatus: test\ndescription: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.\nreferences:\n    - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates\nauthor: '@ionsor'\ndate: 2022-02-08\ntags:\n    - attack.credential-access\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1556\nlogsource:\n    product: azure\n    service: activitylogs\ndetection:\n    selection:\n        eventSource: AzureActiveDirectory\n        eventName: 'Disable Strong Authentication.'\n        status: success\n    condition: selection\nfalsepositives:\n    - Authorized modification by administrators\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","page":"techniques/enterprise/T1556/"}],"data_path":"data/detection-rules/7ea78478-a4f9-42a6-9dcd-f861816122bf.json","kind":"sigma"}