Sigma rule: Disabled MFA to Bypass Authentication Mechanisms

Rule

Title

Disabled MFA to Bypass Authentication Mechanisms

Status

test

Level

medium

Author

@ionsor

Date

2022-02-08

Modified

2026-04-30

File

rules/cloud/azure/audit_logs/azure_mfa_disabled.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Log source

product

azure

service

auditlogs

Detection

selection:
    operationName: 'Disable Strong Authentication'
    properties.result: 'success'
condition: selection

False positives (as the rule lists them)

• Authorized modification by administrators

Tags

• attack.credential-access
• attack.persistence
• attack.defense-impairment
• attack.t1556

MITRE ATT&CK ids this rule names

• T1556

References

• https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
• https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/
• https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/
• https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/audit_logs/azure_mfa_disabled.yml