AN0543
Analytic 0543
Windows
Detects registry and Group Policy modifications that disable or weaken MFA, suspicious PowerShell usage modifying MFA-related attributes, and anomalous login sessions succeeding without expected MFA challenge.
WinEventLog:Security
EventCode=4739
WinEventLog:PowerShell
Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled
[WatchedAttributes]
List of AD attributes or policy fields tied to MFA enforcement that may vary by organization.
[TimeWindow]
Correlation window between MFA policy changes and anomalous login behavior.
AN0544
Analytic 0544
Identity Provider
Detects conditional access policy changes, exclusion of accounts from MFA enforcement, or registration of new MFA factors by non-admin or anomalous users.
azure:signinlogs
Modify Conditional Access Policy
m365:unified
User excluded from MFA or MFA method registered
[PrivilegedRoles]
Roles permitted to modify MFA settings in IdP; helps tune detection of unauthorized changes.
AN0545
Analytic 0545
IaaS
Detects API calls to cloud secrets/MFA configurations where MFA enforcement policies are disabled or bypassed.
AWS:CloudTrail
UpdateIdentityPolicy or DisableMFA
[MonitoredServices]
Specific cloud services or IAM policies relevant to MFA enforcement.
AN0546
Analytic 0546
Linux
Detects PAM module modifications or removal of MFA hooks in /etc/pam.d/ configurations, correlated with successful authentications lacking MFA prompts.
auditd:SYSCALL
open/write to /etc/pam.d/*
NSM:Connections
Successful login without expected MFA challenge
[MFAHooks]
Paths to organization-specific PAM modules enforcing MFA.
AN0547
Analytic 0547
macOS
Detects modifications to authorization plugins responsible for MFA enforcement and correlates with suspicious login sessions missing MFA prompts.
macos:unifiedlog
Modification of /Library/Security/SecurityAgentPlugins
macos:unifiedlog
Login success without MFA step
[WatchedPluginPaths]
Paths to organization-deployed MFA authorization plugins.
AN0548
Analytic 0548
SaaS
Detects suspicious MFA method changes, such as registration of weaker factors (e.g., SMS), or removal of MFA requirements for specific accounts or groups.
saas:zoom
DisableMFA or RegisterNewFactor
[AcceptedFactors]
Configured MFA factors allowed in SaaS environment; tuned to organizational policies.
AN0549
Analytic 0549
Office Suite
Detects MFA bypass attempts by modifying tenant-wide authentication policies or excluding high-value accounts from MFA enforcement.
m365:unified
Set-CsOnlineUser or UpdateAuthPolicy
[MonitoredPolicies]
Specific tenant or suite policies tied to MFA enforcement.