T1556.006 Multi-Factor Authentication Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let MFADisableEvents = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in~ (
    "Disable StrongAuthentication",
    "Update user",
    "User registered security info",
    "User deleted security info",
    "Admin deleted security info",
    "Admin disabled MFA",
    "Update per-user MFA"
  )
| where ResultDescription has_any ("StrongAuthenticationRequirement", "MFA", "authenticator", "phone")
    or OperationName has_any ("StrongAuthentication", "MFA")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, ResultDescription, Actor, TargetUser, Result;
let ConditionalAccessModification = AuditLogs
| where TimeGenerated > ago(24h)
| where LoggedByService =~ "Conditional Access"
| where OperationName in~ ("Add conditional access policy", "Update conditional access policy", "Delete conditional access policy")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend PolicyName = tostring(TargetResources[0].displayName)
| project TimeGenerated, OperationName, PolicyName, Actor, Result;
union MFADisableEvents, ConditionalAccessModification
| sort by TimeGenerated desc

critical severity high confidence

Data Sources

User Account: User Account Modification Active Directory: Active Directory Object Modification Microsoft Entra ID Audit Logs Azure AD Audit Logs

Required Tables

AuditLogs

False Positives

IT helpdesk disabling MFA for a user who lost their authenticator device — should be documented in a change ticket
MFA method registration by legitimate users adding a new phone or authenticator app
Conditional Access Policy updates by authorized administrators during planned policy reviews
Automated user lifecycle management systems that temporarily suspend MFA during account provisioning

Splunk

spl

index=azure_audit OR index=o365_audit
  sourcetype IN ("azure:aad:audit", "o365:management:activity")
| eval OperationType=coalesce(Operation, OperationName)
| where match(OperationType, "(?i)(Disable.*MFA|Update.*StrongAuth|Delete.*security.*info|Admin.*MFA|Per-user MFA|conditional.*access|Update.*policy)")
| eval Actor=coalesce(UserId, InitiatingUser, Actor)
| eval Target=coalesce(ObjectId, TargetUser, Target)
| eval Risk=case(
    match(OperationType, "(?i)Disable.*MFA|Admin.*disable"), "HIGH",
    match(OperationType, "(?i)Delete.*security|Remove.*auth"), "HIGH",
    match(OperationType, "(?i)conditional.*access|Update.*policy"), "MEDIUM",
    1==1, "LOW"
  )
| table _time, Actor, Target, OperationType, Result, Risk
| sort - _time

critical severity high confidence

Data Sources

Azure Active Directory Audit Logs Microsoft 365 Unified Audit Log Identity Provider Audit Events

Required Sourcetypes

azure:aad:audit

False Positives

Helpdesk operations resetting lost authenticator devices for legitimate users
Administrative MFA policy updates authorized through change management
User self-service MFA method registration during onboarding
Break-glass account MFA management for emergency access procedures

Elastic Security (EQL)

eql

any where event.dataset in ("azure.auditlogs", "o365.audit") and (
  (
    (event.action like~ "*StrongAuthentication*"
     or event.action like~ "*MFA*"
     or event.action in~ ("User registered security info", "User deleted security info",
                          "Admin deleted security info", "Update per-user MFA", "Update user"))
    and (
      azure.auditlogs.result_description like~ "*StrongAuthenticationRequirement*"
      or azure.auditlogs.result_description like~ "*MFA*"
      or azure.auditlogs.result_description like~ "*authenticator*"
      or azure.auditlogs.result_description like~ "*phone*"
      or event.action like~ "*StrongAuthentication*"
      or event.action like~ "*MFA*"
    )
  )
  or
  (
    azure.auditlogs.properties.logged_by_service like~ "*Conditional Access*"
    and event.action in~ ("Add conditional access policy", "Update conditional access policy",
                          "Delete conditional access policy")
  )
)

high severity high confidence

Data Sources

Azure Active Directory Audit Logs Microsoft 365 Audit Logs

Required Tables

logs-azure.auditlogs-* logs-o365.audit-*

False Positives

IT or identity administrators legitimately disabling per-user MFA in favour of Conditional Access-based enforcement during an approved policy migration project
End users registering a replacement MFA method (new phone, new authenticator app) during authorised onboarding or device refresh cycles
Automated infrastructure-as-code pipelines (Terraform azuread provider, Bicep templates) updating Conditional Access policies during scheduled maintenance change windows

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username AS Actor,
  QIDNAME(qid) AS OperationType,
  CATEGORYNAME(category) AS Category,
  LOGSOURCENAME(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  CASE
    WHEN LOWER(QIDNAME(qid)) MATCHES '.*(disable.*mfa|admin.*mfa.*disable|strongauthentication.*disabled|admin.*deleted.*security).*'
      THEN 'HIGH'
    WHEN LOWER(QIDNAME(qid)) MATCHES '.*(delete.*security.*info|user.*deleted.*security|remove.*authenticat).*'
      THEN 'HIGH'
    WHEN LOWER(QIDNAME(qid)) MATCHES '.*(conditional.*access.*policy|update.*conditional|add.*conditional|delete.*conditional).*'
      THEN 'MEDIUM'
    WHEN LOWER(QIDNAME(qid)) MATCHES '.*(register.*security.*info|per.*user.*mfa|strongauthentication).*'
      THEN 'LOW'
    ELSE 'INFO'
  END AS RiskLevel
FROM events
WHERE LOGSOURCETYPEID IN (396, 430)
  AND (
    LOWER(QIDNAME(qid)) MATCHES '.*(mfa|strongauthentication|conditional.access|security.info|per.user.mfa).*'
    OR LOWER(payload) MATCHES
      '.*("disable strongauthentication"|"admin disabled mfa"|"update per-user mfa"|"conditional access policy"|strongauthenticationrequirement|"admin deleted security info"|"user deleted security info").*'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC

high severity medium confidence

Data Sources

Microsoft Azure Active Directory Audit (QRadar DSM) Microsoft Office 365 (QRadar DSM)

Required Tables

events

False Positives

Helpdesk staff resetting MFA for locked-out users during authenticated support calls — these appear as admin-initiated security info deletions with legitimate actor UPNs
Azure AD Connect or hybrid identity sync operations that trigger StrongAuthentication attribute writes as part of routine on-premises to cloud directory synchronisation
Privileged Identity Management (PIM) break-glass activation procedures that temporarily add emergency accounts to Conditional Access exclusion groups

Sumo Logic CSE

sql

(_sourceCategory="azure/auditlogs" OR _sourceCategory="o365/audit" OR _sourceCategory=*azure*audit*)
| json field=_raw "operationName" as OperationName nodrop
| json field=_raw "Operation" as O365Operation nodrop
| eval operation = if(!isNull(OperationName) && OperationName != "", OperationName, O365Operation)
| where operation matches /(?i)(Disable.*StrongAuth|.*StrongAuth.*Disable|User.*(registered|deleted).*security.*info|Admin.*(deleted|disabled).*(security.*info|MFA)|Update.*per-user.*MFA|Add.*conditional.*access.*policy|Update.*conditional.*access.*policy|Delete.*conditional.*access.*policy)/
| json field=_raw "properties.initiatedBy.user.userPrincipalName" as AzureActor nodrop
| json field=_raw "properties.initiatedBy.app.displayName" as ServiceActor nodrop
| json field=_raw "UserId" as O365Actor nodrop
| eval Actor = if(!isNull(AzureActor) && AzureActor != "", AzureActor, if(!isNull(O365Actor) && O365Actor != "", O365Actor, ServiceActor))
| json field=_raw "properties.targetResources[0].userPrincipalName" as AzureTarget nodrop
| json field=_raw "ObjectId" as O365Target nodrop
| eval Target = if(!isNull(AzureTarget) && AzureTarget != "", AzureTarget, O365Target)
| json field=_raw "properties.result" as AzureResult nodrop
| json field=_raw "ResultStatus" as O365Result nodrop
| eval Result = if(!isNull(AzureResult), AzureResult, O365Result)
| eval Risk = if(operation matches /(?i)(Disable.*MFA|Admin.*disable.*MFA|Admin.*deleted.*security.*info)/, "HIGH",
               if(operation matches /(?i)(User.*deleted.*security.*info|Remove.*authenticat)/, "HIGH",
                 if(operation matches /(?i)(conditional.*access.*policy|Update.*conditional)/, "MEDIUM",
                   "LOW")))
| fields _messageTime, Actor, Target, operation, Result, Risk
| sort by _messageTime desc

high severity high confidence

Data Sources

Azure Active Directory Audit Logs via Azure Monitor Microsoft Office 365 Management Activity API

Required Tables

azure/auditlogs o365/audit

False Positives

Self-service MFA registration campaigns where large user populations enrol new security info methods simultaneously, generating high event volume with legitimate registrations
Conditional Access policy bulk updates applied programmatically during approved change windows by identity engineering teams using the Microsoft Graph API
Azure AD B2C or external identity provider federation configuration changes that generate 'Update user' events containing StrongAuthentication payloads during initial federation setup

Google Chronicle / SecOps

yaral

rule mfa_modification_t1556_006 {
  meta:
    author = "Detection Engineering"
    description = "Detects MFA disable/modification and Conditional Access policy changes in Azure AD audit logs mapped to Chronicle UDM"
    mitre_attack_technique = "T1556.006"
    mitre_attack_tactic = "Persistence, Defense Evasion, Credential Access"
    severity = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1556/006/"

  events:
    $e.metadata.vendor_name = "Microsoft"
    $e.metadata.product_event_type =~ "(?i)(Disable StrongAuthentication|User registered security info|User deleted security info|Admin deleted security info|Admin disabled MFA|Update per-user MFA|Add conditional access policy|Update conditional access policy|Delete conditional access policy)"
    $e.principal.user.userid = $actor

  condition:
    $e
}

high severity high confidence

Data Sources

Google Chronicle - Azure Active Directory Audit Logs (UDM ingestion) Google Chronicle - Microsoft 365 Audit Logs (UDM ingestion)

Required Tables

UDM Events (requires Microsoft Azure AD audit log parser)

False Positives

Authorised identity administrators performing bulk MFA policy migrations from legacy per-user MFA enforcement to Conditional Access-based MFA, generating multiple policy change events in quick succession
Security team testing Conditional Access policy logic in a non-production tenant whose audit events replicate into the same Chronicle instance used for production detections
Break-glass emergency account procedures that temporarily add privileged accounts to Conditional Access exclusion groups during critical outage response, creating policy update events outside normal business hours

CrowdStrike LogScale (CQL)

cql

// Azure AD MFA modification detection in CrowdStrike LogScale
// Requires Azure AD audit logs ingested via Falcon Data Replicator or Azure Event Hub connector
(#product="azure" #type="auditlog") OR #event_simpleName="AadAuditEvent"
| operationName = /(?i)(Disable StrongAuthentication|User (registered|deleted) security info|Admin (deleted|disabled) (security info|MFA)|Update per-user MFA|Add conditional access policy|Update conditional access policy|Delete conditional access policy)/
| case {
    operationName = /(?i)(Disable.*MFA|Admin.*disable.*MFA|Admin.*deleted.*security|Delete.*security.*info)/ | Risk := "HIGH" ;
    operationName = /(?i)(User.*deleted.*security.*info|Remove.*authenticat)/ | Risk := "HIGH" ;
    operationName = /(?i)(conditional.*access.*policy|Update.*conditional|Add.*conditional)/ | Risk := "MEDIUM" ;
    * | Risk := "LOW"
  }
| Actor := coalesce(initiatedByUserPrincipalName, userPrincipalName, UserName, "unknown")
| Target := coalesce(targetUserPrincipalName, targetObjectId, ObjectId, "unknown")
| table([_time, Actor, Target, operationName, resultDescription, Risk])
| sort(_time, order=desc)

high severity medium confidence

Data Sources

CrowdStrike LogScale - Azure AD Audit Logs (via Falcon Data Replicator or Azure Event Hub) CrowdStrike Falcon Identity Threat Protection (IDP) module

Required Tables

LogScale repository with Azure AD audit log ingestion configured

False Positives

Identity governance tooling (e.g., SailPoint IIQ, Saviynt) performing authorised bulk MFA re-enrolment that generates large volumes of security info registration events with service account actors
Azure AD Connect Health agents triggering StrongAuthentication attribute synchronisation during hybrid identity health checks in environments with on-premises AD FS
Scheduled Conditional Access policy review automation that programmatically applies approved policy baseline templates across multiple Azure AD tenants managed from a central governance platform

Multi-Factor Authentication

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Credential Access

Popular Detections