Microsoft365 MFA Disabled

Description

A user's MFA has been removed

Query · python

import json

from panther_msft_helpers import m365_alert_context


def rule(event):
    if event.get("Operation", "") == "Update user.":
        modified_properties = event.get("ModifiedProperties", [])
        for prop in modified_properties:
            if prop.get("Name", "") == "StrongAuthenticationMethod":
                new_value = prop.get("NewValue")
                old_value = prop.get("OldValue")
                if isinstance(new_value, str):
                    new_value = json.loads(new_value)
                if isinstance(old_value, str):
                    old_value = json.loads(old_value)

                if old_value and not new_value:
                    return True
                break
    return False


def title(event):
    return "Microsoft365: MFA Removed on " f"[{event.get('ObjectId', '')}]"


def alert_context(event):
    return m365_alert_context(event)

Analyst notes

Depending on company policy, either suggest or require the user re-enable two step verification.

Raw source Microsoft365 MFA Disabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: A user's MFA has been removed
DisplayName: "Microsoft365 MFA Disabled"
Enabled: true
Filename: microsoft365_mfa_disabled.py
Reports:
  MITRE ATT&CK:
    - TA003:T1556 # Persistence - Modify Authentication Process
    - TA005:T1556 # Defense Evansion - Modify Authentication Process
    - TA006:T1556 # Credential Access - Modify Authentication Process
Runbook: Depending on company policy, either suggest or require the user re-enable two step verification.
Reference: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide
Severity: Low
Tests:
  - ExpectedResult: false
    Log:
      Actor:
        - ID: Azure MFA StrongAuthenticationService
          Type: 1
        - ID: ABC-123
          Type: 2
        - ID: ServicePrincipal_123-abc
          Type: 2
        - ID: 321-cba
          Type: 2
        - ID: ServicePrincipal
          Type: 2
      ActorContextId: 123-abc-456
      AzureActiveDirectoryEventType: 1
      CreationTime: "2022-12-12 17:28:35"
      ExtendedProperties:
        - Name: additionalDetails
          Value: '{"UserType":"Member"}'
        - Name: extendedAuditEventCategory
          Value: User
      Id: 123-abc-123
      InterSystemsId: abc-123-321
      IntraSystemId: aa-bbb-333
      ModifiedProperties:
        - Name: StrongAuthenticationMethod
          NewValue: '[{"Default": true,"MethodType": 7}]'
          OldValue: "[]"
        - Name: Included Updated Properties
          NewValue: StrongAuthenticationMethod
          OldValue: ""
        - Name: TargetId.UserType
          NewValue: Member
          OldValue: ""
      ObjectId: sample.user@yourorg.onmicrosoft.com
      Operation: Update user.
      OrganizationId: 111-222-333
      RecordType: 8
      ResultStatus: Success
      SupportTicketId: ""
      Target:
        - ID: User_111-222-bbb
          Type: 2
        - ID: 111-aa-bbb-321
          Type: 2
        - ID: User
          Type: 2
        - ID: sample.user@yourorg.onmicrosoft.com
          Type: 5
        - ID: 123abcdef
          Type: 3
      TargetContextId: aaa-bb-222
      UserId: ServicePrincipal_aa-bb-ccc
      UserKey: Not Available
      UserType: 4
      Workload: AzureActiveDirectory
    Name: MFA Add Event
  - ExpectedResult: true
    Log:
      Actor:
        - ID: Azure MFA StrongAuthenticationService
          Type: 1
        - ID: ABC-123
          Type: 2
        - ID: ServicePrincipal_123-abc
          Type: 2
        - ID: 321-cba
          Type: 2
        - ID: ServicePrincipal
          Type: 2
      ActorContextId: 123-abc-456
      AzureActiveDirectoryEventType: 1
      CreationTime: "2022-12-12 17:28:35"
      ExtendedProperties:
        - Name: additionalDetails
          Value: '{"UserType":"Member"}'
        - Name: extendedAuditEventCategory
          Value: User
      Id: 123-abc-123
      InterSystemsId: abc-123-321
      IntraSystemId: aa-bbb-333
      ModifiedProperties:
        - Name: StrongAuthenticationMethod
          NewValue: "[]"
          OldValue: '[{"Default": true,"MethodType": 7}]'
        - Name: Included Updated Properties
          NewValue: StrongAuthenticationMethod
          OldValue: ""
        - Name: TargetId.UserType
          NewValue: Member
          OldValue: ""
      ObjectId: sample.user@yourorg.onmicrosoft.com
      Operation: Update user.
      OrganizationId: 111-222-333
      RecordType: 8
      ResultStatus: Success
      SupportTicketId: ""
      Target:
        - ID: User_111-222-bbb
          Type: 2
        - ID: 111-aa-bbb-321
          Type: 2
        - ID: User
          Type: 2
        - ID: sample.user@yourorg.onmicrosoft.com
          Type: 5
        - ID: 123abcdef
          Type: 3
      TargetContextId: aaa-bb-222
      UserId: ServicePrincipal_aa-bb-ccc
      UserKey: Not Available
      UserType: 4
      Workload: AzureActiveDirectory
    Name: MFA Remove event
DedupPeriodMinutes: 60
LogTypes:
  - Microsoft365.Audit.AzureActiveDirectory
RuleID: "Microsoft365.MFA.Disabled"
Threshold: 1


# ------ paired body: microsoft365_mfa_disabled.py ------

import json

from panther_msft_helpers import m365_alert_context


def rule(event):
    if event.get("Operation", "") == "Update user.":
        modified_properties = event.get("ModifiedProperties", [])
        for prop in modified_properties:
            if prop.get("Name", "") == "StrongAuthenticationMethod":
                new_value = prop.get("NewValue")
                old_value = prop.get("OldValue")
                if isinstance(new_value, str):
                    new_value = json.loads(new_value)
                if isinstance(old_value, str):
                    old_value = json.loads(old_value)

                if old_value and not new_value:
                    return True
                break
    return False


def title(event):
    return "Microsoft365: MFA Removed on " f"[{event.get('ObjectId', '')}]"


def alert_context(event):
    return m365_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.