Azure AD Audit Logs: Certificate-based authentication enabled via AuthenticationMethodsPolicy update
Flags Azure AD audit log events where the Authentication Methods policy is updated to enable certificate-based authentication.
- Product
- azure
- Service
- auditlogs
- Author
- Harjot Shah Singh, '@cyb3rjy0t' (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies changes in Azure Active Directory where the tenant’s authentication methods policy is updated and includes the AuthenticationMethodsPolicy property. Enabling certificate-based authentication can support passwordless access and persistence, including granting alternate authentication paths that may be difficult to spot in day-to-day activity. It relies on Azure audit log events for the operation name Authentication Methods Policy Update and matches on modifiedProperties containing AuthenticationMethodsPolicy.
Reporting behind it
- posts.specterops.iohttps://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
- goodworkaround.comhttps://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure AD Audit Logs: Certificate-based authentication enabled via AuthenticationMethodsPolicy update"
id: d4148b9c-a43b-45f0-bc74-52f95c5b3ed7
status: test
description: This rule identifies changes in Azure Active Directory where the tenant’s authentication methods policy is updated and includes the AuthenticationMethodsPolicy property. Enabling certificate-based authentication can support passwordless access and persistence, including granting alternate authentication paths that may be difficult to spot in day-to-day activity. It relies on Azure audit log events for the operation name Authentication Methods Policy Update and matches on modifiedProperties containing AuthenticationMethodsPolicy.
references:
- https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml
author: Harjot Shah Singh, '@cyb3rjy0t', Huntrule Team
date: 2024-03-26
tags:
- attack.credential-access
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
OperationName: Authentication Methods Policy Update
TargetResources.modifiedProperties|contains: AuthenticationMethodsPolicy
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c2496b41-16a9-4016-a776-b23f8910dc58
type: derived