Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0

title: "Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0"
id: 203ef5d2-c31c-4554-b495-1aa5b774ec98
status: test
description: This rule flags Azure AD audit log events where a user account is updated and the StrongAuthenticationRequirement setting is changed to a disabled state (state value of 0). Disabling MFA materially weakens account security and can enable account takeover or persistence by allowing authentication without multi-factor challenges. The detection relies on Azure “Core Directory” UserManagement “Update user” audit log entries that modify the StrongAuthenticationRequirement property and include the new value indicating State=0.
references:
  - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml
author: Harjot Singh (@cyb3rjy0t), Huntrule Team
date: 2024-08-21
tags:
  - attack.credential-access
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
  definition: "Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work"
detection:
  selection:
    LoggedByService: Core Directory
    Category: UserManagement
    OperationName: Update user
    TargetResources.ModifiedProperties.DisplayName: StrongAuthenticationRequirement
    TargetResources.ModifiedProperties.NewValue|contains: State":0
  condition: selection
falsepositives:
  - Legitimate authorized activity.
level: medium
license: DRL-1.1
related:
  - id: b18454c8-0be3-41f7-86bc-9c614611b839
    type: derived