Azure Audit Logs: User registered security info (authentication method change)

Flags Azure AD audit events where a user registers new authentication security info.

FreeReviewedSigma · Medium · v5

Product: azure
Service: auditlogs
Author: AlertIQ (SigmaHQ), DRL 1.1
Published: 2021-10-10
Updated: 2026-07-31

ATT&CK techniques

Persistence → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098Account Manipulation
- T1556Modify Authentication Process
Priv Esc
- T1098Account Manipulation
Defense Evasion
- T1556Modify Authentication Process
Cred Access
- T1556Modify Authentication Process
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Azure audit log events where a user registers security info under the Authentication Methods service for UserManagement. Attackers may add or change authentication methods to maintain or extend access after initial compromise. Detection relies on Azure Audit Logs entries with LoggedByService set to Authentication Methods, along with the matching UserManagement category and operation name 'User registered security info'.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Suspicious AWS SAML Identity Provider Creation

Suspicious Okta Sign-On Policy Lifecycle Modification

Possible Shadow Credentials Abuse via msDS-KeyCredentialLink Modification

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

Suspicious Domain Admin Account Creation via net (via process_creation)

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

Suspicious dMSA Object Access with Migration AccessMask

Azure Audit Logs: User registered security info (authentication method change)

Pivot detection · T1098 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-ad-user-registers-new-security-info-authentication-method-change-4d78a000

title: "Azure Audit Logs: User registered security info (authentication method change)"
id: 6f83aac9-58b6-459f-9578-1be69144f171
status: test
description: This rule flags Azure audit log events where a user registers security info under the Authentication Methods service for UserManagement. Attackers may add or change authentication methods to maintain or extend access after initial compromise. Detection relies on Azure Audit Logs entries with LoggedByService set to Authentication Methods, along with the matching UserManagement category and operation name 'User registered security info'.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    LoggedByService: Authentication Methods
    Category: UserManagement
    OperationName: User registered security info
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4d78a000-ab52-4564-88a5-7ab5242b20c7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL