GitHub Two Factor Auth Disable

Back


Id	3ff0fffb-d963-40c0-b235-3404f915add7
Rulename	GitHub Two Factor Auth Disable
Description	Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - Two Factor Authentication Disabled in GitHub.yaml
Version	1.0.2
Arm template	3ff0fffb-d963-40c0-b235-3404f915add7.json

KQL

GitHubAuditData
| where Action == "org.disable_two_factor_requirement"
| project TimeGenerated, Action, Actor, Country, Repository
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

YAML

relevantTechniques:
- T1562
name: GitHub Two Factor Auth Disable
queryFrequency: 1d
version: 1.0.2
triggerThreshold: 0
severity: Medium
requiredDataConnectors: []
tactics:
- DefenseEvasion
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - Two Factor Authentication Disabled in GitHub.yaml
query: |
  GitHubAuditData
  | where Action == "org.disable_two_factor_requirement"
  | project TimeGenerated, Action, Actor, Country, Repository
  | extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
  | extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")  
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: Actor
    identifier: FullName
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
queryPeriod: 1d
triggerOperator: gt
id: 3ff0fffb-d963-40c0-b235-3404f915add7
status: Available
description: |
    'Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected. '

ARM