Red Sift - MFA disabled on account

Back


Id	16f26d2c-6296-490b-af4f-b30bcf1c4461
Rulename	Red Sift - MFA disabled on account
Description	This query searches for authentication events where MFA has been disabled on an account, which may indicate account takeover activity, weakened account protections, or unauthorized administrative changes.
Severity	High
Tactics	DefenseEvasion
Techniques	T1556
Required data connectors	RedSiftPush
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red Sift/Analytic Rules/RedSiftMFADisabled.yaml
Version	1.0.0
Arm template	16f26d2c-6296-490b-af4f-b30bcf1c4461.json

KQL

RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    ActorUserEmail = tostring(column_ifexists("ActorUserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", "")),
    HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
    ServiceName = tostring(column_ifexists("ServiceName", "")),
    Severity = tostring(column_ifexists("Severity", "")),
    UserUid = tostring(column_ifexists("UserUid", "")),
    ActorUserUid = tostring(column_ifexists("ActorUserUid", ""))
| where ActivityName =~ "MFA Disabled"
| where isnotempty(UserEmail) or isnotempty(ActorUserEmail)
| extend TargetAccount = iff(isnotempty(UserEmail), UserEmail, ActorUserEmail)
| project
    TimeGenerated,
    TargetAccount,
    UserEmail,
    ActorUserEmail,
    SrcIp,
    HttpUserAgent,
    ServiceName,
    ActivityName,
    Severity,
    UserUid,
    ActorUserUid

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: TargetAccount
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIp
tactics:
- DefenseEvasion
suppressionEnabled: false
suppressionDuration: PT1H
requiredDataConnectors:
- dataTypes:
  - RedSiftAuth_CL
  connectorId: RedSiftPush
alertDetailsOverride:
  alertDisplayNameFormat: RedSift - MFA Disabled for {{TargetAccount}}
  alertDescriptionFormat: 'MFA was disabled for {{TargetAccount}}. Actor: {{ActorUserEmail}}. Source IP: {{SrcIp}}.'
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: P1D
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
  createIncident: true
id: 16f26d2c-6296-490b-af4f-b30bcf1c4461
severity: High
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
customDetails:
  ActivityName: ActivityName
  UserAgent: HttpUserAgent
  ActorUserEmail: ActorUserEmail
  ServiceName: ServiceName
query: |
  RedSiftAuth_CL
  | extend
      ActivityName = tostring(column_ifexists("ActivityName", "")),
      UserEmail = tostring(column_ifexists("UserEmail", "")),
      ActorUserEmail = tostring(column_ifexists("ActorUserEmail", "")),
      SrcIp = tostring(column_ifexists("SrcIp", "")),
      HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
      ServiceName = tostring(column_ifexists("ServiceName", "")),
      Severity = tostring(column_ifexists("Severity", "")),
      UserUid = tostring(column_ifexists("UserUid", "")),
      ActorUserUid = tostring(column_ifexists("ActorUserUid", ""))
  | where ActivityName =~ "MFA Disabled"
  | where isnotempty(UserEmail) or isnotempty(ActorUserEmail)
  | extend TargetAccount = iff(isnotempty(UserEmail), UserEmail, ActorUserEmail)
  | project
      TimeGenerated,
      TargetAccount,
      UserEmail,
      ActorUserEmail,
      SrcIp,
      HttpUserAgent,
      ServiceName,
      ActivityName,
      Severity,
      UserUid,
      ActorUserUid  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red Sift/Analytic Rules/RedSiftMFADisabled.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.0
name: Red Sift - MFA disabled on account
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1556
description: |
    This query searches for authentication events where MFA has been disabled on an account, which may indicate account takeover activity, weakened account protections, or unauthorized administrative changes.
triggerOperator: gt

ARM