Every published rule

AWS CloudTrail Successful ConsoleLogin Events Without MFA

Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

Alert on Duo successful MFA logins that are attributed to bypass-user codes.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Azure PIM Role Activation Without MFA Alert (noMfaOnRoleActivationAlertIncident)

Alerts when Azure PIM signals role activation occurred without MFA.

Okta FastPass blocks phishing authentication attempts via MFA

Alerts on Okta FastPass MFA failures where the declined reason indicates a known phishing attempt.

Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)

Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.

Azure Sign-In: Successful single-factor atRisk logins from non-registered devices

Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.

Azure AD Sign-in Success Without MFA (Single-Factor Authentication)

Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.

Azure Sign-In Logs: Device Registration or Join Success Without MFA

Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.

Azure Sign-in Logs: MFA Denied Based on Authentication Requirement

Flags Azure sign-ins requiring MFA where the status indicates "MFA Denied."

Azure Audit Logs: Successful Disable Strong Authentication Indicates MFA Disabled

Alerts on successful MFA disable actions in Azure audit logs that could weaken account authentication.

Azure Sign-in Log MFA Interrupted via Strong Auth Failures

Identifies Azure sign-ins that fail during strong/MFA authentication, suggesting blocked credential attempts.

Okta MFA Deactivation or Full Factor Reset Event Detection

Flags Okta events indicating MFA deactivation or reset_all actions by a user or actor.

Google Workspace: Admin audit events where strong authentication is allowed without enforcement (MFA disabled)

Alerts on Google Workspace admin changes that set strong authentication/MFA enforcement to false.