Suspicious Multi Factor Authentication Disabled For User Account (via auditlogs)

title: Suspicious Multi Factor Authentication Disabled For User Account (via auditlogs)
id: e49ab3d4-1c34-5ce1-a901-d8eb213e2003
status: stable
description: This rule detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users to maintain or achieve access to the account. Also see in SIM Swap attacks.
references:
    - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
author: Huntrule Team
date: 2026-07-09
tags:
    - attack.credential-access
    - attack.persistence
    - attack.defense-evasion
    - attack.t1556.006
logsource:
    product: azure
    service: auditlogs
    definition: 'Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work'
detection:
    selection:
        LoggedByService: 'Core Directory'
        Category: 'UserManagement'
        OperationName: 'Update user'
        TargetResources.ModifiedProperties.DisplayName: 'StrongAuthenticationRequirement'
        TargetResources.ModifiedProperties.NewValue|contains: "State\":0"
    condition: selection
falsepositives:
    - Unknown
level: medium