Azure AD: User registers new security info (authentication method change)

title: "Azure AD: User registers new security info (authentication method change)"
id: 6f83aac9-58b6-459f-9578-1be69144f171
status: test
description: This rule identifies Azure audit log events where a user registers security information under the “Authentication Methods” service. Attackers may add or change authentication methods to maintain access or enable account takeover via alternate sign-in factors. The detection relies on Azure Audit Logs fields indicating the logged-by service, user management category, and the specific operation name for registering security info.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    LoggedByService: Authentication Methods
    Category: UserManagement
    OperationName: User registered security info
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4d78a000-ab52-4564-88a5-7ab5242b20c7
    type: derived