User Risk and MFA Registration Policy Updated

Rule Info

Name
User Risk and MFA Registration Policy Updated
Author
Harjot Singh (@cyb3rjy0t)
Description
Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.
Reference
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
Date
2024-08-13 00:00:00
Modified
None
Id
d4c7758e-9417-4f2e-9109-6125d66dabef
Tags
attack.persistence DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=d4c7758e-9417-4f2e-9109-6125d66dabef

Rule History

Author
Title
Date
Commit
cyb3rjy0t
Merge PR #4977 from @cyb3rjy0t - Add `User Risk and MFA Registration Policy Updated`
2024-08-21
78abfd570
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022