Name:Azure AD Multi-Factor Authentication Disabled id:482dd42a-acfa-486b-a0bb-d6fcda27318e version:14 date:None author:Mauricio Velazco, Gowthamaraj Rajendran, Splunk status:production type:TTP Description:The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment. Data_source:
-Azure Active Directory Disable Strong Authentication
how_to_implement:You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category. known_false_positives:Legitimate use case may require for users to disable MFA. Filter as needed. References: -https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks -https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates -https://attack.mitre.org/tactics/TA0005/ -https://attack.mitre.org/techniques/T1556/ drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Azure Active Directory Account Takeover', 'Scattered Lapsus$ Hunters']
