Red Sift - MFA disabled on account | Microsoft Sentinel Analytic Rules

Back


Id	16f26d2c-6296-490b-af4f-b30bcf1c4461
Rulename	Red Sift - MFA disabled on account
Description	This query searches for authentication events where MFA has been disabled on an account, which may indicate account takeover activity, weakened account protections, or unauthorized administrative changes.
Severity	High
Tactics	DefenseEvasion
Techniques	T1556
Required data connectors	RedSiftPush
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftMFADisabled.yaml
Version	1.0.0
Arm template	16f26d2c-6296-490b-af4f-b30bcf1c4461.json

KQL

RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    ActorUserEmail = tostring(column_ifexists("ActorUserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", "")),
    HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
    ServiceName = tostring(column_ifexists("ServiceName", "")),
    Severity = tostring(column_ifexists("Severity", "")),
    UserUid = tostring(column_ifexists("UserUid", "")),
    ActorUserUid = tostring(column_ifexists("ActorUserUid", ""))
| where ActivityName =~ "MFA Disabled"
| where isnotempty(UserEmail) or isnotempty(ActorUserEmail)
| extend TargetAccount = iff(isnotempty(UserEmail), UserEmail, ActorUserEmail)
| project
    TimeGenerated,
    TargetAccount,
    UserEmail,
    ActorUserEmail,
    SrcIp,
    HttpUserAgent,
    ServiceName,
    ActivityName,
    Severity,
    UserUid,
    ActorUserUid

YAML

suppressionDuration: PT1H
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftMFADisabled.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - RedSiftAuth_CL
  connectorId: RedSiftPush
tactics:
- DefenseEvasion
relevantTechniques:
- T1556
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P1D
    matchingMethod: Selected
    enabled: true
    reopenClosedIncident: false
    groupByEntities:
    - Account
  createIncident: true
alertDetailsOverride:
  alertDescriptionFormat: 'MFA was disabled for {{TargetAccount}}. Actor: {{ActorUserEmail}}. Source IP: {{SrcIp}}.'
  alertDisplayNameFormat: RedSift - MFA Disabled for {{TargetAccount}}
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: TargetAccount
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: SrcIp
  entityType: IP
description: |
  This query searches for authentication events where MFA has been disabled on an account, which may indicate account takeover activity, weakened account protections, or unauthorized administrative changes.
triggerOperator: gt
suppressionEnabled: false
status: Available
queryFrequency: 1h
kind: Scheduled
id: 16f26d2c-6296-490b-af4f-b30bcf1c4461
name: Red Sift - MFA disabled on account
severity: High
query: |
  RedSiftAuth_CL
  | extend
      ActivityName = tostring(column_ifexists("ActivityName", "")),
      UserEmail = tostring(column_ifexists("UserEmail", "")),
      ActorUserEmail = tostring(column_ifexists("ActorUserEmail", "")),
      SrcIp = tostring(column_ifexists("SrcIp", "")),
      HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
      ServiceName = tostring(column_ifexists("ServiceName", "")),
      Severity = tostring(column_ifexists("Severity", "")),
      UserUid = tostring(column_ifexists("UserUid", "")),
      ActorUserUid = tostring(column_ifexists("ActorUserUid", ""))
  | where ActivityName =~ "MFA Disabled"
  | where isnotempty(UserEmail) or isnotempty(ActorUserEmail)
  | extend TargetAccount = iff(isnotempty(UserEmail), UserEmail, ActorUserEmail)
  | project
      TimeGenerated,
      TargetAccount,
      UserEmail,
      ActorUserEmail,
      SrcIp,
      HttpUserAgent,
      ServiceName,
      ActivityName,
      Severity,
      UserUid,
      ActorUserUid
queryPeriod: 1h
customDetails:
  ServiceName: ServiceName
  ActorUserEmail: ActorUserEmail
  UserAgent: HttpUserAgent
  ActivityName: ActivityName

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/16f26d2c-6296-490b-af4f-b30bcf1c4461')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/16f26d2c-6296-490b-af4f-b30bcf1c4461')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "MFA was disabled for {{TargetAccount}}. Actor: {{ActorUserEmail}}. Source IP: {{SrcIp}}.",
          "alertDisplayNameFormat": "RedSift - MFA Disabled for {{TargetAccount}}"
        },
        "alertRuleTemplateName": "16f26d2c-6296-490b-af4f-b30bcf1c4461",
        "customDetails": {
          "ActivityName": "ActivityName",
          "ActorUserEmail": "ActorUserEmail",
          "ServiceName": "ServiceName",
          "UserAgent": "HttpUserAgent"
        },
        "description": "This query searches for authentication events where MFA has been disabled on an account, which may indicate account takeover activity, weakened account protections, or unauthorized administrative changes.\n",
        "displayName": "Red Sift - MFA disabled on account",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "TargetAccount",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftMFADisabled.yaml",
        "query": "RedSiftAuth_CL\n| extend\n    ActivityName = tostring(column_ifexists(\"ActivityName\", \"\")),\n    UserEmail = tostring(column_ifexists(\"UserEmail\", \"\")),\n    ActorUserEmail = tostring(column_ifexists(\"ActorUserEmail\", \"\")),\n    SrcIp = tostring(column_ifexists(\"SrcIp\", \"\")),\n    HttpUserAgent = tostring(column_ifexists(\"HttpUserAgent\", \"\")),\n    ServiceName = tostring(column_ifexists(\"ServiceName\", \"\")),\n    Severity = tostring(column_ifexists(\"Severity\", \"\")),\n    UserUid = tostring(column_ifexists(\"UserUid\", \"\")),\n    ActorUserUid = tostring(column_ifexists(\"ActorUserUid\", \"\"))\n| where ActivityName =~ \"MFA Disabled\"\n| where isnotempty(UserEmail) or isnotempty(ActorUserEmail)\n| extend TargetAccount = iff(isnotempty(UserEmail), UserEmail, ActorUserEmail)\n| project\n    TimeGenerated,\n    TargetAccount,\n    UserEmail,\n    ActorUserEmail,\n    SrcIp,\n    HttpUserAgent,\n    ServiceName,\n    ActivityName,\n    Severity,\n    UserUid,\n    ActorUserUid\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1556"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}