[go: up one dir, main page]

Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Rule: Multi Factor Authentication Disabled For User Account #4978

Merged
merged 2 commits into from
Aug 21, 2024

Conversation

cyb3rjy0t
Copy link
Contributor
@cyb3rjy0t cyb3rjy0t commented Aug 19, 2024

Summary of the Pull Request

Threat Actor reset the password to maintain or achieve access to the account. Common indicator seen in SIM Swap attacks.

Changelog

new: Multi Factor Authentication Disabled For User Account

Example Log Event

"properties": {
  "userAgent": null,
  "identity": "",
  "tenantGeo": "NA",
  "loggedByService": "Core Directory",
  "activityDateTime": "2022-06-25T11:00:0+00:00",
  "correlationId": "",
  "resultDescription": "",
  "id": "",
  "operationType": "Update",
  "tenantId": "",
  "targetResources": [
    {
      "modifiedProperties": [
        {
          "newValue": "[{\"RelyingParty\":\"*\",\"State\":0,\"RememberDevicesNotIssuedBefore\":\"2022-06-25T11:00:0+00:00\",\"ConfigStore\":{\"IsInitialized\":true,\"SupportsDataDeployment\":true,\"ConfigEnvironment\":{\"BaseDirectory\":\"\",\"Environment\":,\"Ring\":\"\",\"Role\":\"webapplication\",\"Site\":\"\",\"IsServiceFabric\":,\"IsLsm\":,\"IsConfigDiffTool\":,\"EnableCellConsistentRollout\":,\"EnableAllCloudsStagedRollout\":false,\"LoadFlatteningValues\":false,\"NoThrowOnUnknownTestAssembly\":false,\"IsDirectoryStoreReplica\":},\"ConfigSource\":{}}}]",
          "displayName": "StrongAuthenticationRequirement",
          "oldValue": "[{\"RelyingParty\":\"*\",\"State\":1,\"RememberDevicesNotIssuedBefore\":\"2022-06-25T11:00:00+00:00\",\"ConfigStore\":null}]"
        },
        {
          "newValue": "\"StrongAuthenticationRequirement\"",
          "displayName": "Included Updated Properties",
          "oldValue": null
        },
        {
          "newValue": "\"Member\"",
          "displayName": "TargetId.UserType",
          "oldValue": null
        }
      ],
      "administrativeUnits": [],
      "type": "User",
      "displayName": null,
      "id": "",
      "userPrincipalName": "user@microsoft.com"
    }
  ],
  "result": "success",
  "resultReason": "",
  "category": "UserManagement",
  "operationName": "Update user",
  "activityDisplayName": "Update user",
  "resultType": "",
  "additionalDetails": [
    {
      "key": "UserType",
      "value": "Member"
    }
  ],
  "initiatedBy": {
    "user": {
      "roles": [],
      "ipAddress": "",
      "id": "",
      "displayName": null,
      "userPrincipalName": "user@microsoft.com"
    }
  }
}

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

Threat Actor reset the password to maintain or achieve access to the account. Common indicator seen in SIM Swap attacks.
@github-actions github-actions bot added the Rules label Aug 19, 2024
@nasbench nasbench added the Cloud Pull request add/update cloud related rules label Aug 21, 2024
@nasbench nasbench changed the title Create azure_user_account_mfa_disable.yml Add Rule: Multi Factor Authentication Disabled For User Account Aug 21, 2024
@nasbench nasbench merged commit d114395 into SigmaHQ:master Aug 21, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Cloud Pull request add/update cloud related rules Rules
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants