Modify Authentication Process: Conditional Access Policies `T1556.009`

Tactics: Defense Impairment, Persistence, Credential Access

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.

Authoring guide

These 14 rules share fields, values, and exclusions.

Fields filtered most (40 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	5	`eq` 5	`aws.cloudtrail`, `azure.auditlogs`, `azure.graphactivitylogs`, `azure.signinlogs`, `okta.system`
`EventType`	3	`eq` 2, `in` 2	`CreateDBCluster`, `CreateDBInstance`, `ModifyDBInstance`, `application.policy.sign_on.rule.delete`, `application.policy.sign_on.update`
`event.outcome`	3	`eq` 3	`success`
`event.OperationName`	2	`in` 2	`CreateAllowlistGroup`, `UpdateAllowlistGroup`
`eventTypeName`	2	`eq` 2	`NETWORK_PERMISSION_ENTRY_ADDED`, `ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED`
`JustifiedPIM`	1	`eq` 1	`false`
`NewValueIsTrusted`	1	`eq` 1	`true`
`OperationName`	1	`contains` 1, `eq` 1, `in` 1	`Add member to group`, `Add named location`, `Delete conditional access policy`
`PimJustification`	1	`contains` 1	`ca`, `conditional access`, `location`
`Provider_Name`	1	`eq` 1	`rds.amazonaws.com`
`Reasons`	1	`ne` 1	`[]`
`TargetResources_modifiedProperties`	1	`contains` 1	`ca-exclude`, `ca-include`
`action`	1	`eq` 1	`UpdateIPRestrictions`
`aws::requestParameters`	1	`contains` 1	`publiclyaccessible=true`
`azure.signinlogs.properties.app_owner_tenant_id`	1	`eq` 1	`f8cdef31-a31e-4b4a-93e4-5f571e91255a`

Top indicator values (62 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS RDS DB Instance Made Public elasticEntra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN elasticEntra ID Conditional Access Policy (CAP) Modified	3	375
`event.OperationName`	`in`	`CreateAllowlistGroup` pantherCrowdstrike IP Allowlist Changed pantherCrowdstrike Single IP Allowlisted	2	2
`event.OperationName`	`in`	`UpdateAllowlistGroup` pantherCrowdstrike IP Allowlist Changed pantherCrowdstrike Single IP Allowlisted	2	2
`EventType`	`eq`	`ModifyDBInstance` elasticAWS RDS DB Instance Made Public	1	2
`EventType`	`eq`	`update conditional access policy` elasticEntra ID Conditional Access Policy (CAP) Modified	1
`EventType`	`in`	`CreateDBCluster` elasticAWS RDS DB Instance Made Public	1
`EventType`	`in`	`CreateDBInstance` elasticAWS RDS DB Instance Made Public	1
`EventType`	`in`	`application.policy.sign_on.rule.delete` elasticModification or Removal of an Okta Application Sign-On Policy	1
`EventType`	`in`	`application.policy.sign_on.update` elasticModification or Removal of an Okta Application Sign-On Policy	1
`JustifiedPIM`	`eq`	`false` kustoDetect suspicious conditional access policy modifications	1
`NewValueIsTrusted`	`eq`	`true` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`contains`	`completed (pim activation)` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`eq`	`Add member to group` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`eq`	`Remove member from group` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`in`	`Add named location` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`in`	`Delete conditional access policy` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`in`	`Update conditional access policy` kustoDetect suspicious conditional access policy modifications	1
`OperationName`	`in`	`Update named location` kustoDetect suspicious conditional access policy modifications	1
`PimJustification`	`contains`	`ca` kustoDetect suspicious conditional access policy modifications	1
`PimJustification`	`contains`	`conditional access` kustoDetect suspicious conditional access policy modifications	1
`PimJustification`	`contains`	`location` kustoDetect suspicious conditional access policy modifications	1
`PimJustification`	`contains`	`named` kustoDetect suspicious conditional access policy modifications	1
`PimJustification`	`contains`	`trusted` kustoDetect suspicious conditional access policy modifications	1
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS DB Instance Made Public	1	9
`Reasons`	`ne`	`[]` kustoDetect suspicious conditional access policy modifications	1
`TargetResources_modifiedProperties`	`contains`	`ca-exclude` kustoDetect suspicious conditional access policy modifications	1
`TargetResources_modifiedProperties`	`contains`	`ca-include` kustoDetect suspicious conditional access policy modifications	1
`action`	`eq`	`UpdateIPRestrictions` pantherWiz Update IP Restrictions	1
`aws::requestParameters`	`contains`	`publiclyaccessible=true` elasticAWS RDS DB Instance Made Public	1
`azure.signinlogs.properties.app_owner_tenant_id`	`eq`	`f8cdef31-a31e-4b4a-93e4-5f571e91255a` elasticEntra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN	1

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`pulumi` elasticAWS RDS DB Instance Made Public	1
`aws::userAgent`	`contains`	`terraform` elasticAWS RDS DB Instance Made Public	1

Modify Authentication Process: Conditional Access Policies `T1556.009`

Authoring guide

Fields filtered most (40 distinct)

Top indicator values (62 distinct)

Exclusions (2 distinct)

Rules under this technique

Elastic 5 rules

Kusto 1 rule

Panther 8 rules

Modify Authentication Process: Conditional Access Policies T1556.009

Authoring guide

Fields filtered most (40 distinct)

Top indicator values (62 distinct)

Exclusions (2 distinct)

Rules under this technique

Elastic 5 rules

Kusto 1 rule

Panther 8 rules

Modify Authentication Process: Conditional Access Policies `T1556.009`