Cross-source coverage

T1556.009 / ATT&CK

Modify Authentication Process: Conditional Access Policies

14 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.

For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication. In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain condition attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested. These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required.

By modifying conditional access policies, such as adding additional trusted IP ranges, removing Multi-Factor Authentication requirements, or allowing additional Unused/Unsupported Cloud Regions, adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.

Platforms
IaaS · Identity Provider
Telemetry
AWS:CloudTrailazure:activitysaas:okta

How MITRE says to detect it DET0030

Detect Conditional Access Policy Modification in Identity and Cloud Platforms

IaaS Analytic 0087

Detects modifications to IAM conditions or policies that alter authentication behavior, such as adding permissive trusted IPs, removing MFA requirements, or changing regional access restrictions. Behavioral detection focuses on anomalous policy updates tied to privileged accounts and subsequent suspicious logon activity from previously blocked regions or devices.

  • AWS:CloudTrail PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion

Identity Provider Analytic 0088

Detects suspicious updates to conditional access or MFA enforcement policies in identity providers such as Entra ID, Okta, or JumpCloud. Focus is on removal of policy blocks, addition of broad exclusions, or registration of adversary-controlled MFA methods, followed by anomalous login activity that takes advantage of the modified policies.

  • azure:activity Update conditionalAccessPolicy
  • saas:okta Conditional Access policy rule modified or MFA requirement disabled

View on attack.mitre.org ↗

panther-labs/panther-analysis

8 rules
Detection Severity Format
Azure Authentication Methods Policy OIDC Discovery URL Changed High Panther Python
GCP Org or Folder Policy Was Changed Manually High Panther Python
MongoDB access allowed from anywhere High Panther Python
MongoDB org membership restriction disabled High Panther Python
Wiz Update IP Restrictions High Panther Python
Crowdstrike Single IP Allowlisted Medium Panther Python
ZIA Insecure Password Settings Medium Panther Python
Crowdstrike IP Allowlist Changed Informational Panther Python

elastic/detection-rules

5 rules
Detection Severity Format
Entra ID Conditional Access Policy (CAP) Modified High Elastic TOML
AWS RDS DB Instance Made Public Medium Elastic TOML
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN Medium Elastic TOML
Entra ID External Authentication Methods (EAM) Modified Medium Elastic TOML
Modification or Removal of an Okta Application Sign-On Policy Medium Elastic TOML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Conditional Access policy exclusion added Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.