Multi-Factor Authentication Disabled for a User

Status: available
Severity: medium
Time window: 1h
Group by: AADTenantId, Category, CorrelationId, IPAddress, InitiatedByUser, Operation, Source, TenantorInstance_Detail, Type, User
Source: github.com/Azure/Azure-Sentinel

Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation `T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Provider	Record / event type
AWS	CloudTrail event `DeactivateMFADevice`: Deactivates an MFA device previously associated with an IAM user, removing the MFA requirement for that user.
AWS	CloudTrail event `DeleteVirtualMFADevice`: Deletes a virtual MFA device, permanently removing it from the account.
Entra-AuditLogs	Disable Strong Authentication

Rules detecting the same action

These rules filter on the same operation.

[Entra ID] Authentication Method Changed for Privileged Account (Kusto)
Account Created and Deleted in Short Timeframe (Kusto)
Account Created And Deleted Within A Close Time Frame (Sigma)
Account created from non-approved sources (Kusto)
Account created or deleted by non-approved user (Kusto)
Addition of a Temporary Access Pass to a Privileged Account (Kusto)
ASL AWS Multi-Factor Authentication Disabled (Splunk)
Authentication Method Changed for Privileged Account (Kusto)

Rule body

id: 65c78944-930b-4cae-bd79-c3664ae30ba7
name: Multi-Factor Authentication Disabled for a User
description: |
  'Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to deactivate MFA for a user.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
     - AuditLogs
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - Persistence
relevantTechniques:
  - T1098
  - T1556
query: |
 (union isfuzzy=true
 (AuditLogs
 | where OperationName =~ "Disable Strong Authentication"
 | extend _parsedIntiatedByUser = parse_json(tostring(InitiatedBy.user))
 | extend _parsedIntiatedByApp = parse_json(tostring(InitiatedBy.app))
 | extend IPAddress = tostring(_parsedIntiatedByUser.ipAddress)
 | extend InitiatedByUser = iff(isnotempty(tostring(_parsedIntiatedByUser.userPrincipalName)),
  tostring(_parsedIntiatedByUser.userPrincipalName), tostring(_parsedIntiatedByApp.displayName))
 | extend Targetprop = todynamic(TargetResources)
 | extend TargetUser = tostring(Targetprop[0].userPrincipalName)
 | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, InitiatedByUser , Operation = OperationName , CorrelationId, IPAddress, Category, Source = SourceSystem , AADTenantId, Type
 ),
 (AWSCloudTrail
 | where EventName in~ ("DeactivateMFADevice", "DeleteVirtualMFADevice")
 | extend _parsedRequestParameters = parse_json(RequestParameters)
 | extend InstanceProfileName = tostring(_parsedRequestParameters.InstanceProfileName)
 | extend TargetUser = tostring(_parsedRequestParameters.userName)
 | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, Source = EventSource , Operation = EventName , TenantorInstance_Detail = InstanceProfileName, IPAddress = SourceIpAddress
 )
 )
 | extend timestamp = StartTimeUtc, UserName = tostring(split(User, '@', 0)[0]), UPNSuffix = tostring(split(User, '@', 1)[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: UserName
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.5
kind: Scheduled

Stages and Predicates

Stage 1: `union`

union of 2 branches

Stage 2: `source`

AuditLogs

Stage 3: `where`

| where OperationName =~ "Disable Strong Authentication"

Stage 4: `extend` (6 consecutive steps)

| extend _parsedIntiatedByUser = parse_json(tostring(InitiatedBy.user))
| extend _parsedIntiatedByApp = parse_json(tostring(InitiatedBy.app))
| extend IPAddress = tostring(_parsedIntiatedByUser.ipAddress)
| extend InitiatedByUser = iff(isnotempty(tostring(_parsedIntiatedByUser.userPrincipalName)),
 tostring(_parsedIntiatedByUser.userPrincipalName), tostring(_parsedIntiatedByApp.displayName))
| extend Targetprop = todynamic(TargetResources)
| extend TargetUser = tostring(Targetprop[0].userPrincipalName)

Stage 5: `summarize`

| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, InitiatedByUser , Operation = OperationName , CorrelationId, IPAddress, Category, Source = SourceSystem , AADTenantId, Type

Stage 6: `source`

AWSCloudTrail

Stage 7: `where`

| where EventName in~ ("DeactivateMFADevice", "DeleteVirtualMFADevice")

Stage 8: `extend` (3 consecutive steps)

| extend _parsedRequestParameters = parse_json(RequestParameters)
| extend InstanceProfileName = tostring(_parsedRequestParameters.InstanceProfileName)
| extend TargetUser = tostring(_parsedRequestParameters.userName)

Stage 9: `summarize`

| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, Source = EventSource , Operation = EventName , TenantorInstance_Detail = InstanceProfileName, IPAddress = SourceIpAddress

Stage 10: `extend`

extend UPNSuffix, UserName, timestamp

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventName`	in	`DeactivateMFADevice` `DeleteVirtualMFADevice`	`field:"aws::eventName" kind:in`
`OperationName`	eq	`Disable Strong Authentication`	`field:"OperationName" kind:eq value:"Disable Strong Authentication"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTimeUtc`	`summarize`
`IPAddress`	`summarize`
`Operation`	`summarize`
`Source`	`summarize`
`StartTimeUtc`	`summarize`
`TenantorInstance_Detail`	`summarize`
`User`	`summarize`
`UPNSuffix`	`extend`
`UserName`	`extend`
`timestamp`	`extend`

Multi-Factor Authentication Disabled for a User

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: union

Stage 2: source

Stage 3: where

Stage 4: extend (6 consecutive steps)

Stage 5: summarize

Stage 6: source

Stage 7: where

Stage 8: extend (3 consecutive steps)

Stage 9: summarize

Stage 10: extend