Modify Authentication Process: Multi-Factor Authentication T1556.006
Tactics: Defense Impairment, Persistence, Credential Access
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Authoring guide
These 33 rules share fields, values, and exclusions.
Fields filtered most (52 distinct)
These fields appear most often in rule filters.
Top indicator values (102 distinct)
These values appear most often in rule predicates.
Exclusions (8 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Azure AD Only Single Factor Authentication Required
- Disabling Multi Factor Authentication
- Okta MFA Reset or Deactivated
Elastic 11 rules
- Attempt to Deactivate an Okta Policy
- Attempt to Delete an Okta Policy
- Attempt to Reset MFA Factors for an Okta User Account
- AWS IAM Deactivation of MFA Device
- AWS IAM Virtual MFA Device Registration Attempt with Session Token
- AWS STS AssumeRole with New MFA Device
- Entra ID MFA Disabled for User
- Entra ID User Sign-in with Unusual Authentication Type
- Google Workspace MFA Enforcement Disabled For Organization
- MFA Deactivation with no Re-Activation for Okta User Account
- Stolen Credentials Used to Login to Okta Account After MFA Reset
Splunk 11 rules
- ASL AWS Multi-Factor Authentication Disabled
- ASL AWS New MFA Method Registered For User
- AWS Multi-Factor Authentication Disabled
- AWS New MFA Method Registered For User
- Azure AD Multi-Factor Authentication Disabled
- Azure AD New MFA Method Registered For User
- GCP Multi-Factor Authentication Disabled
- Okta Multi-Factor Authentication Disabled
- PingID Mismatch Auth Source and Verification Response
- PingID New MFA Method After Credential Reset
- PingID New MFA Method Registered For User
Kusto 2 rules
YARA-L 4 rules
- AWS MultiFactor Authentication Disabled
- AWS New MFA Method Registered For User
- Okta User Password and MFA Factor Reset or Deactivated
- OneLogin User Authentication Factor Removed