Cross-source coverage

T1556.006 / ATT&CK

Modify Authentication Process: Multi-Factor Authentication

35 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor Authentication Request Generation, adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.

For example, modifying the Windows hosts file (C:\windows\system32\drivers\etc\hosts) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA.

Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.

Platforms
IaaS · Identity Provider · Linux · macOS · Office Suite · SaaS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:PowerShellazure:signinlogsm365:unifiedAWS:CloudTrailauditd:SYSCALLNSM:Connectionsmacos:unifiedlogsaas:zoom

How MITRE says to detect it DET0190

Detect MFA Modification or Disabling Across Platforms

Windows Analytic 0543

Detects registry and Group Policy modifications that disable or weaken MFA, suspicious PowerShell usage modifying MFA-related attributes, and anomalous login sessions succeeding without expected MFA challenge.

  • WinEventLog:Security EventCode=4739
  • WinEventLog:PowerShell Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled

Identity Provider Analytic 0544

Detects conditional access policy changes, exclusion of accounts from MFA enforcement, or registration of new MFA factors by non-admin or anomalous users.

  • azure:signinlogs Modify Conditional Access Policy
  • m365:unified User excluded from MFA or MFA method registered

IaaS Analytic 0545

Detects API calls to cloud secrets/MFA configurations where MFA enforcement policies are disabled or bypassed.

  • AWS:CloudTrail UpdateIdentityPolicy or DisableMFA

Linux Analytic 0546

Detects PAM module modifications or removal of MFA hooks in /etc/pam.d/ configurations, correlated with successful authentications lacking MFA prompts.

  • auditd:SYSCALL open/write to /etc/pam.d/*
  • NSM:Connections Successful login without expected MFA challenge

macOS Analytic 0547

Detects modifications to authorization plugins responsible for MFA enforcement and correlates with suspicious login sessions missing MFA prompts.

  • macos:unifiedlog Modification of /Library/Security/SecurityAgentPlugins
  • macos:unifiedlog Login success without MFA step

SaaS Analytic 0548

Detects suspicious MFA method changes, such as registration of weaker factors (e.g., SMS), or removal of MFA requirements for specific accounts or groups.

  • saas:zoom DisableMFA or RegisterNewFactor

Office Suite Analytic 0549

Detects MFA bypass attempts by modifying tenant-wide authentication policies or excluding high-value accounts from MFA enforcement.

  • m365:unified Set-CsOnlineUser or UpdateAuthPolicy

View on attack.mitre.org ↗

elastic/detection-rules

11 rules
Detection Severity Format
AWS IAM Deactivation of MFA Device High Elastic TOML
AWS IAM Virtual MFA Device Registration Attempt with Session Token High Elastic TOML
Google Workspace MFA Enforcement Disabled For Organization High Elastic TOML
Stolen Credentials Used to Login to Okta Account After MFA Reset High Elastic TOML
Attempt to Delete an Okta Policy Medium Elastic TOML
Entra ID MFA Disabled for User Medium Elastic TOML
Entra ID User Sign-in with Unusual Authentication Type Medium Elastic TOML
Attempt to Deactivate an Okta Policy Low Elastic TOML
Attempt to Reset MFA Factors for an Okta User Account Low Elastic TOML
AWS STS AssumeRole with New MFA Device Low Elastic TOML

+ 1 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

11 rules
Detection Severity Format
ASL AWS Multi-Factor Authentication Disabled Undefined SPL
ASL AWS New MFA Method Registered For User Undefined SPL
AWS Multi-Factor Authentication Disabled Undefined SPL
AWS New MFA Method Registered For User Undefined SPL
Azure AD Multi-Factor Authentication Disabled Undefined SPL
Azure AD New MFA Method Registered For User Undefined SPL
GCP Multi-Factor Authentication Disabled Undefined SPL
Okta Multi-Factor Authentication Disabled Undefined SPL
PingID Mismatch Auth Source and Verification Response Undefined SPL
PingID New MFA Method After Credential Reset Undefined SPL

+ 1 more from splunk/security_content → showing the 10 highest-severity

Azure/Azure-Sentinel

4 rules
Detection Severity Format
Account MFA Modifications Undefined KQL
MFA method registered from an IP address not seen in user sign-in history Undefined KQL
Sign-in from unseen IP within 60 minutes of MFA disabled for account Undefined KQL
Temporary Access Pass created for user account Undefined KQL

chronicle/detection-rules

4 rules
Detection Severity Format
onelogin_user_authentication_factor_removed High YARA-L
aws_multi_factor_authentication_disabled Medium YARA-L
aws_new_mfa_method_registered_for_user Medium YARA-L
okta_user_password_and_mfa_factor_reset_or_deactivated Medium YARA-L

SigmaHQ/sigma

3 rules
Detection Severity Format
Disabling Multi Factor Authentication High Sigma
Okta MFA Reset or Deactivated Medium Sigma
Azure AD Only Single Factor Authentication Required Low Sigma

panther-labs/panther-analysis

2 rules
Detection Severity Format
Slack MFA Settings Changed High Panther Python
Azure Domain Federation Settings Modified Medium Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.