Azure Entra Audit Logs: StrongAuthenticationRequirement Set to Disabled or State 0

Alerts on Azure Entra user updates that change StrongAuthenticationRequirement to a disabled State ("State":0).

FreeUnreviewedSigmamediumv1

azure-entra-audit-logs-strongauthenticationrequirement-set-to-disabled-or-state--b18454c8

title: "Azure Entra Audit Logs: StrongAuthenticationRequirement Set to Disabled or State 0"
id: 203ef5d2-c31c-4554-b495-1aa5b774ec98
status: test
description: This rule flags user-management update events in Azure Entra audit logs where the StrongAuthenticationRequirement property is modified and set to a disabled state (State":0). Disabling multi-factor authentication weakens account security and can enable persistence or easier account access for an attacker. The detection relies on Core Directory user update audit events and the specific StrongAuthenticationRequirement property value change telemetry.
references:
  - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml
author: Harjot Singh (@cyb3rjy0t), Huntrule Team
date: 2024-08-21
tags:
  - attack.credential-access
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
  definition: "Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work"
detection:
  selection:
    LoggedByService: Core Directory
    Category: UserManagement
    OperationName: Update user
    TargetResources.ModifiedProperties.DisplayName: StrongAuthenticationRequirement
    TargetResources.ModifiedProperties.NewValue|contains: State":0
  condition: selection
falsepositives:
  - Legitimate authorized activity.
level: medium
license: DRL-1.1
related:
  - id: b18454c8-0be3-41f7-86bc-9c614611b839
    type: derived

What it detects

This rule flags user-management update events in Azure Entra audit logs where the StrongAuthenticationRequirement property is modified and set to a disabled state (State":0). Disabling multi-factor authentication weakens account security and can enable persistence or easier account access for an attacker. The detection relies on Core Directory user update audit events and the specific StrongAuthenticationRequirement property value change telemetry.

Known false positives

Legitimate authorized activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.