huntrule

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

FreeUnreviewedSigmahighv1
title: "Microsoft 365 Audit: Disabling Strong Authentication (MFA)"
id: 13099bbb-ec46-4eb3-95c6-ad3b1dd5f9a5
status: test
description: This rule flags Microsoft 365 audit events where the operation indicates MFA was disabled by matching the text 'Disable Strong Authentication.' Disabling strong authentication is a defense-impairment action attackers can use to reduce account protections and facilitate credential misuse. The detection relies on Microsoft 365 audit log data with the operation field containing that exact phrase.
references:
  - https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_disabling_mfa.yml
author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule), Huntrule Team
date: 2023-09-18
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556.006
logsource:
  service: audit
  product: m365
detection:
  selection:
    Operation|contains: Disable Strong Authentication.
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 60de9b57-dc4d-48b9-a6a0-b39e0469f876
    type: derived

What it detects

This rule flags Microsoft 365 audit events where the operation indicates MFA was disabled by matching the text 'Disable Strong Authentication.' Disabling strong authentication is a defense-impairment action attackers can use to reduce account protections and facilitate credential misuse. The detection relies on Microsoft 365 audit log data with the operation field containing that exact phrase.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.