Date: 08/22/2024
Severity: High
Summary
Detects modifications and updates to the user risk and MFA registration policies. Attackers may alter these policies to bypass MFA, lower security thresholds, enable additional attacks, or maintain persistence.
Indicators of Compromise (IOC) List
LoggedByService | 'AAD Management UX' |
Category | 'Policy' |
OperationName | 'Update User Risk and MFA Registration Policy' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | ((resourceName = "Azure AD Directory Audit" AND loggedbyservice = "AAD Management UX" ) AND category = "Policy" ) AND operationtype = "Update User Risk and MFA Registration Policy" |
Detection Query 2 | ((Technologygroup = "EDR" AND loggedbyservice = "AAD Management UX" ) AND category = "Policy" ) AND operationtype = "Update User Risk and MFA Registration Policy" |
Reference:
Sigma Detection Rule for Azure Risk and MFA Registration Policy Updates
Microsoft Learn Guide to Configuring MFA Policy in Microsoft Entra ID Protection
Microsoft Entra ID Audit Activities Reference