Push Security SaaS App MFA Method Changed

Description

MFA method on SaaS app changed

Query · python

def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    if event.get("old") is None:
        return False

    new_mfa_methods = set(event.deep_get("new", "mfaMethods"))
    old_mfa_methods = set(event.deep_get("old", "mfaMethods", default=[]))

    if new_mfa_methods != old_mfa_methods:
        return True

    return False


def severity(event):
    if event.deep_get("new", "mfaMethods") == []:
        return "HIGH"
    return "LOW"


def title(event):
    mfa_methods = ", ".join(event.deep_get("new", "mfaMethods", default="No MFA"))
    new_email = event.deep_get("new", "email")
    new_apptype = event.deep_get("new", "appType")

    if mfa_methods == "":
        return f"{new_email} removed all MFA methods on {new_apptype}"
    return f"{new_email} changed MFA method to {mfa_methods} on {new_apptype}"

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: 2024-05-21
Modified: 2024-05-21
Authored by: panther-labs
Source ID
Upstream: rules/push_security_rules/push_security_mfa_method_changed.yml
Type: rule
Version: 1
Data sources: PushSecurity.Entities

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.