synoti logosynoti logo
Cloud Azure

Detection rules for Azure Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 46 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Application Gateway WAF Security AlertsInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
Azure AD Anomalous Token DetectionCredential AccessT1528 - Steal Application Access TokenC:3 / I:2 / A:1
Azure AD App Registration with High-Privilege API PermissionsPersistenceT1098.001 - Account Manipulation: Additional Cloud CredentialsC:3 / I:3 / A:1
Azure AD Application Credential AddedPersistenceT1098.001 - Account Manipulation: Additional Cloud CredentialsC:3 / I:3 / A:2
Azure AD Bulk Privileged Role Assignment ChangesPrivilege EscalationT1098 - Account ManipulationC:3 / I:3 / A:2
Azure AD Device Code Authentication Flow DetectedInitial AccessT1078 - Valid AccountsC:3 / I:2 / A:1
Azure AD Federation Settings ModifiedCredential AccessT1556 - Modify Authentication ProcessC:3 / I:3 / A:3
Azure AD Golden SAML and Federation Domain AbuseCredential AccessT1606.002 - Forge Web Credentials: SAML TokensC:3 / I:3 / A:2
Azure AD Impossible Travel Sign-InInitial AccessT1078 - Valid AccountsC:3 / I:2 / A:1
Azure AD Impossible Travel Sign-In DetectionCredential AccessT1078 - Valid AccountsC:3 / I:2 / A:1
Azure AD LAPS Password RecoveryCredential AccessT1003 - OS Credential DumpingC:3 / I:2 / A:1
Azure AD Leaked Credentials DetectionCredential AccessT1078 - Valid AccountsC:3 / I:3 / A:2
Azure AD New Root Certificate Authority AddedPersistenceT1556 - Modify Authentication ProcessC:3 / I:3 / A:2
Azure AD Password Spray Attack DetectedCredential AccessT1110.003 - Brute Force: Password SprayingC:3 / I:2 / A:1
Azure AD Password Spray Attack DetectionCredential AccessT1110 - Brute ForceC:3 / I:2 / A:1
Azure AD Privileged App Role AssignmentPrivilege EscalationT1098.003 - Account Manipulation: Additional Cloud RolesC:3 / I:3 / A:2
Azure AD Resource Owner Password Credentials Flow DetectedCredential AccessT1078 - Valid AccountsC:2 / I:2 / A:1
Azure AD Temporary Access Pass RegistrationCredential AccessT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:2 / A:1
Azure AKS Container Security Threat DetectionExecutionT1610 - Deploy ContainerC:3 / I:3 / A:2
Azure Active Directory High Risk Sign-inInitial AccessT1078 - Valid AccountsC:3 / I:3 / A:2
Azure Application Credential ModificationDefense EvasionT1098.001 - Account Manipulation: Additional Cloud CredentialsC:3 / I:3 / A:2
Azure Automation Runbook AbuseExecutionT1059 - Command and Scripting InterpreterC:3 / I:3 / A:2
Azure Defender for Cloud Critical Security AlertIntrusion DetectionTA0001 - Initial AccessC:3 / I:3 / A:2
Azure Diagnostic Settings DeletionDefense EvasionT1562.008 - Impair Defenses: Disable Cloud LogsC:1 / I:3 / A:3
Azure Diagnostic Settings TamperingDefense EvasionT1562.008 - Impair Defenses: Disable Cloud LogsC:2 / I:3 / A:2
Azure Disk Snapshot ExfiltrationData ExfiltrationT1537 - Transfer Data to Cloud AccountC:3 / I:2 / A:1
Azure Event Hub DeletionDefense EvasionT1562.008 - Impair Defenses: Disable Cloud LogsC:1 / I:3 / A:3
Azure Global Administrator Role Addition to PIM UserPersistenceT1098.001 - Account Manipulation: Additional Cloud CredentialsC:3 / I:3 / A:3
Azure Key Vault Excessive Access DetectedCollectionT1530 - Data from Cloud Storage ObjectC:3 / I:2 / A:1
Azure Key Vault ModifiedCredential AccessT1552 - Unsecured CredentialsC:3 / I:3 / A:2
Azure Kubernetes Admission Webhook ModifiedPersistenceT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:3 / A:2
Azure Kubernetes Events DeletedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:1 / I:3 / A:2
Azure Kubernetes Secret Write or DeleteCredential AccessT1552.007 - Unsecured Credentials: Container APIC:3 / I:3 / A:2
Azure Managed Identity Token AbuseCredential AccessT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:3 / A:1
Azure PIM Role Activation AnomalyPrivilege EscalationT1078 - Valid AccountsC:3 / I:3 / A:1
Azure Primary Refresh Token Access AttemptCredential AccessT1528 - Steal Application Access TokenC:3 / I:3 / A:1
Azure Security Alert Suppression Rule CreatedDefense EvasionT1562 - Impair DefensesC:2 / I:3 / A:2
Azure Sentinel High/Critical Alert Pattern DetectionThreat DetectionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Azure Service Principal Credentials AddedPersistenceT1098.001 - Account Manipulation: Additional Cloud CredentialsC:3 / I:3 / A:2
Azure Subscription Ownership Transfer DetectedIdentity and Access ManagementT1078 - Valid AccountsC:3 / I:3 / A:2
Azure Subscription Permission Elevation via ElevateAccessPrivilege EscalationT1078.004 - Valid Accounts: Cloud AccountsC:3 / I:3 / A:3
AzureHound Reconnaissance Tool DetectedDiscoveryT1087.004 - Account Discovery: Cloud AccountC:2 / I:1 / A:0
MFA Disabled for Privileged Azure AD UserDefense EvasionT1556 - Modify Authentication ProcessC:3 / I:3 / A:1
Multi-Factor Authentication Disabled for an Azure UserPersistenceT1556 - Modify Authentication ProcessC:3 / I:3 / A:2
Possible Consent Grant Attack via Azure-Registered ApplicationInitial AccessT1078 - Valid AccountsC:3 / I:3 / A:2
Storage Account Public Access EnabledCollectionT1530 - Data from Cloud Storage ObjectC:3 / I:2 / A:1

Rule Example

Below is an example of a rule definition for Application Gateway WAF Security Alerts (view in repository):

# Rule version v1.0.0

dataTypes:
  - azure
name: Application Gateway WAF Security Alerts
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Initial Access
technique: "T1190 - Exploit Public-Facing Application"
adversary: origin
references:
  - https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-logs
  - https://attack.mitre.org/techniques/T1190/
description: |
  Detects Web Application Firewall alerts from Azure Application Gateway indicating potential web attacks or malicious activity. This rule triggers when WAF blocks or detects suspicious requests that match security rules.
  
  **Next Steps:**
  1. Review the specific WAF rule ID and message details to understand the attack type
  2. Analyze the source IP address for reputation and geographic location
  3. Examine the request URL, headers, and payload for attack indicators
  4. Check for additional requests from the same source IP within the time window
  5. Verify if this is a legitimate application behavior or actual attack attempt
  6. Consider implementing additional WAF rules or IP blocking if confirmed malicious
  7. Review application logs for any successful bypass attempts
where: |
  (equals("log.operationName", "ApplicationGatewayFirewallLog") || equals("log.type", "ApplicationGatewayFirewallLog")) &&
  equals("log.action", "Blocked") &&
  exists("log.ruleId")
afterEvents:
  - indexPattern: v1-7-22-log-azure-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
    within: now-10m
    count: 5
groupBy:
  - lastEvent.log.ruleId
  - adversary.ip

Rule Details

Application Gateway WAF Security Alerts

Identifies Web Application Firewall alerts originating from Azure Application Gateway that point to possible web attacks or malicious behavior. The rule fires when WAF blocks or detects suspicious requests matching security rules.

**

Azure AD Anomalous Token Detection

Identifies Azure Identity Protection alerts for abnormal tokens that have unusual lifetimes, unfamiliar locations, or other suspicious characteristics. Such alerts suggest possible token theft or tampering.

Azure AD App Registration with High-Privilege API Permissions

Identifies when new Azure AD application registrations are created, which attackers may use to establish persistence through high-privilege API permissions. They create app registrations with permissions such as Mail.ReadWrite, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to preserve access.

Azure AD Application Credential Added

Identifies the addition of new certificates or client secrets to Azure AD application registrations. This is the main Azure AD persistence method: attackers attach credentials to existing apps so they keep access even after password resets.

Azure AD Bulk Privileged Role Assignment Changes

Identifies bulk changes to privileged role assignments in Azure AD. Several role assignments within a brief time frame signal an attacker quickly escalating privileges across many accounts for persistence and lateral movement.

Azure AD Device Code Authentication Flow Detected

Identifies OAuth device code flow authentication in Azure AD. Device code phishing is an expanding attack method in which attackers deceive users into authenticating on a device controlled by the attacker, giving the attacker access tokens.

Azure AD Federation Settings Modified

Identifies changes to Azure AD domain federation settings. Modifying federation configuration is a critical attack technique that enables Golden SAML attacks and domain takeover, letting attackers forge authentication tokens for any user.

Azure AD Golden SAML and Federation Domain Abuse

Detects new or modified federated domains in Azure AD that could indicate Golden SAML attacks. If attackers compromise AD FS signing certificates or introduce rogue federation domains, they can forge SAML tokens to impersonate any user in the organization.

Azure AD Impossible Travel Sign-In

Identifies Azure Identity Protection impossible travel alerts in which a user signs in from geographically distant locations within a time frame that makes physical travel impossible. This is a strong indicator of credential theft or session hijacking.

Azure AD Impossible Travel Sign-In Detection

Identifies Azure AD sign-ins marked as risky because of impossible travel, anonymous IP usage, or unfamiliar locations. These risk detections suggest possible credential compromise when a user authenticates from geographically impossible locations or via anonymizing services.

Azure AD LAPS Password Recovery

Identifies Local Administrator Password Solution (LAPS) password recovery from Entra ID. Although LAPS recovery is a valid admin operation, excessive or unauthorized recovery attempts point to credential dumping for lateral movement.

Azure AD Leaked Credentials Detection

Identifies Azure Identity Protection alerts for leaked credentials discovered on the dark web, paste sites, or other sources. This means user credentials have been exposed and could be used for unauthorized access.

Azure AD New Root Certificate Authority Added

Identifies when a new root certificate authority is added to the TrustedCAsForPasswordlessAuth configuration in Azure AD. Adding a rogue root CA creates persistent backdoor access through passwordless authentication.

Azure AD Password Spray Attack Detected

Identifies Azure Identity Protection password spray attack signals. Microsoft's ML-based detection flags distributed password spray attempts across multiple accounts that use common passwords.

Azure AD Password Spray Attack Detection

Identifies password spray attacks against Azure AD by correlating failed sign-in attempts across multiple usernames from the same source IP within a brief time window. Password spraying attempts common passwords against many accounts to evade account lockout thresholds.

Azure AD Privileged App Role Assignment

Identifies privileged app role assignments to service principals in Azure AD, the mechanism used in illicit consent grant attacks. Attackers create or modify applications with high-privilege API permissions to reach organizational data.

Azure AD Resource Owner Password Credentials Flow Detected

Identifies use of the Resource Owner Password Credentials (ROPC) OAuth flow in Azure AD. ROPC sends plain-text credentials straight to the token endpoint, bypassing MFA and conditional access. Attackers commonly abuse it for credential stuffing and automated account compromise.

Azure AD Temporary Access Pass Registration

Identifies registration of Temporary Access Pass (TAP) in Azure AD. TAPs can bypass MFA requirements and are an expanding attack vector for initial access and MFA circumvention.

Azure AKS Container Security Threat Detection

Identifies suspicious container operations in Azure Kubernetes Service (AKS), such as privileged pod creation, container exec commands, and possible container escape attempts. These activities may signal an attacker trying to deploy malicious workloads or break out of container isolation.

Azure Active Directory High Risk Sign-in

Identifies high-risk Azure Active Directory (AD) sign-ins by using Microsoft's Identity Protection machine learning and heuristics. Identity Protection classifies risk into three tiers: low, medium, and high. Although Microsoft does not disclose specific details about how risk is calculated, each level provides greater confidence that the user or sign-in is compromised. This rule fires on high risk level sign-ins, which show strong indicators of compromise such as impossible travel, anonymous IP usage, or leaked credentials.

Azure Application Credential Modification

Identifies when a new credential, either a certificate or a secret, is added to an Azure AD application. Applications can authenticate when requesting tokens by using certificates or secret strings. Adversaries might add extra authentication credentials to existing applications to achieve persistence, avoid defenses, or allow privilege escalation by impersonating legitimate applications.

This technique is commonly used in post-compromise scenarios where attackers:

Azure Automation Runbook Abuse

Detects the creation or modification of Azure Automation runbooks, which can be exploited to run code with managed identity privileges. Attackers might create runbooks to execute arbitrary code, gain persistence, or move laterally by using the automation account's managed identity.

Azure Defender for Cloud Critical Security Alert

Identifies critical severity alerts from Azure Defender for Cloud that indicate possible active threats, malware infections, or successful breach attempts requiring immediate response.

Azure Diagnostic Settings Deletion

Detects deletion of diagnostic settings in Azure, which are essential for sending platform logs, metrics, and activity data to destinations such as Log Analytics workspaces, Event Hubs, or storage accounts. Adversaries remove diagnostic settings to evade detection by turning off security monitoring and audit logging capabilities.

This technique is commonly observed when attackers:

  • Attempt to hide malicious activities from security teams

  • Disable logging before executing destructive operations

  • Remove evidence trails of their presence in the environment

  • Prevent detection of lateral movement or data exfiltration

Legitimate deletions are rare and typically occur only during:

Azure Diagnostic Settings Tampering

Detects deletion or modification of Azure diagnostic settings used to route platform logs and metrics to monitoring destinations. Attackers might disable diagnostic settings so their activities are not logged and detected.

Azure Disk Snapshot Exfiltration

Detects Azure disk snapshot operations that may be used for data exfiltration, such as sharing snapshots across subscriptions, creating SAS URIs for download, or copying snapshots to external storage accounts.

Azure Event Hub Deletion

Detects deletion of an Azure Event Hub, a critical event processing service that ingests and processes large volumes of events, logs, and telemetry data. Event Hubs are often used for security monitoring, log aggregation, and SIEM integration. Adversaries might delete Event Hubs to evade detection by disrupting log collection pipelines and stopping security events from reaching monitoring systems.

Threat Context:

  • Event Hubs are often used to stream logs to SIEM solutions

  • Deletion interrupts security monitoring and incident detection capabilities

  • Can be part of anti-forensics activities to cover tracks

  • May indicate an attempt to blind security operations before further attacks

Legitimate Use Cases:

  • Decommissioning unused Event Hubs during cost optimization

  • Infrastructure cleanup during application retirement

  • Migration to new Event Hub namespaces or different logging solutions

  • Testing and development environment cleanup

Suspicious Indicators:

Azure Global Administrator Role Addition to PIM User

Detects when users receive Global Administrator (Company Administrator) role assignments through Azure AD/Entra ID Privileged Identity Management (PIM).

Security Context:
The Global Administrator role is the most powerful administrative role in Azure AD/Entra ID, providing complete control over every aspect of the directory and services that use Azure AD identities. PIM enables just-in-time privileged access through eligible assignments that require activation or time-bound assignments. Adversaries who obtain sufficient privileges might add themselves or other compromised accounts to this role to establish persistence and retain full administrative control over the tenant.

Detection Logic:
This rule watches AuditLogs for successful PIM role assignments that target the Global Administrator role. It identifies both:

  • Eligible assignments (permanent): User can activate the role when needed

  • Active assignments (time-bound): Role is directly active for a specified duration

The rule finds these assignments by operation names and applies a filter specifically for the Global Administrator role.

Investigation Steps:

  1. Identify the assignor: Check log.propertiesInitiatedBy for who made the role assignment

  2. Identify the assignee: Examine log.propertiesTargetResources for the user receiving the role

  3. Verify authorization: Confirm if this assignment was part of approved privileged access request

  4. Check assignment type: Determine if it's eligible (requires activation) or time-bound (direct)

  5. Review duration: For time-bound assignments, check the duration of the assignment

  6. Analyze timing: Determine if assignment follows suspicious authentication or compromise indicators

  7. Review justification: Check if a business justification was provided in log.propertiesAdditionalDetails

  8. Check user history: Review the assignee's account for recent suspicious activity

  9. Examine recent actions: Look for privileged operations performed immediately after assignment

  10. Correlate with sign-ins: Check for unusual authentication patterns before/after assignment

Recommended Actions:

  • If unauthorized, immediately revoke the Global Administrator role assignment

  • Review all recent PIM role assignments for anomalies

  • Enable PIM approval workflows for Global Administrator role assignments

  • Implement maximum assignment duration limits for time-bound assignments

  • Require MFA and justification for all Global Administrator activations

  • Enable PIM alerts for high-privilege role assignments

  • Audit accounts with Privileged Role Administrator permissions

  • Review and limit the number of permanent Global Administrator assignments

  • Enable Azure AD Identity Protection to detect compromised credentials

  • Implement break-glass emergency access accounts following best practices

PIM Assignment Types:

  • Eligible (permanent): User must activate the role when needed, typically with MFA and justification

  • Active (time-bound): Role is directly assigned for a limited duration without activation required

  • Both types should be monitored as adversaries may use either for persistence

Common Attack Patterns:

  • Compromised Privileged Role Administrator adding backdoor accounts

  • Insider threat establishing persistent administrative access

  • Privilege escalation from lower-privilege administrative roles

  • Adding service principals or managed identities to Global Administrator role

  • Creating long-duration time-bound assignments for sustained access

MITRE ATT&CK Reference: T1098.001 - Account Manipulation: Additional Cloud Credentials

Azure Documentation:

Azure Key Vault Excessive Access Detected

Detects abnormal surges in Azure Key Vault access patterns. Watches for several secret retrieval operations originating from the same source, which may point to credential harvesting or data exfiltration attempts.

Azure Key Vault Modified

Identifies changes to a Key Vault in Azure. The Key Vault is a service that protects encryption keys and secrets such as certificates, connection strings, and passwords. Since this data is sensitive and business critical, access to key vaults should be locked down so only authorized applications and users can reach it. Adversaries might alter Key Vault configurations to weaken security controls, add unauthorized access policies, or change network rules to enable credential theft and unauthorized access to sensitive secrets.

Azure Kubernetes Admission Webhook Modified

Detects the creation or modification of MutatingAdmissionWebhook or ValidatingAdmissionWebhook configurations in Azure Kubernetes Service. Attackers leverage admission controllers to inject malicious containers or alter workload specifications.

Azure Kubernetes Events Deleted

Detects the deletion of Kubernetes events in Azure Kubernetes Service (AKS). Attackers remove events to hide traces of their activity inside the cluster.

Azure Kubernetes Secret Write or Delete

Monitors write and delete activities on Kubernetes Secrets in Azure Kubernetes Service. Secrets contain sensitive data such as service account tokens, TLS certificates, and database credentials. Unauthorized access points to possible credential theft or data tampering.

Azure Managed Identity Token Abuse

Detects suspicious token retrieval from Azure Instance Metadata Service (IMDS) by managed identities. Attackers who compromise an Azure VM can misuse managed identities to get access tokens for Azure resources without credentials, which enables lateral movement across the cloud environment.

Azure PIM Role Activation Anomaly

Detects abnormal Privileged Identity Management (PIM) role activation patterns, including activation of high-privilege roles such as Global Administrator or Privileged Role Administrator. Repeated or unusual PIM activations can indicate an attacker using compromised credentials to escalate privileges.

Azure Primary Refresh Token Access Attempt

Identifies attempts to obtain the Primary Refresh Token (PRT) in Azure AD. Because PRTs grant SSO access to all Azure AD-integrated applications and can be used to evade conditional access policies, PRT theft is a high-confidence indicator of compromise.

Azure Security Alert Suppression Rule Created

Detects the creation of alert suppression rules in Azure Defender / Microsoft Defender for Cloud. Attackers create suppression rules to conceal security alerts generated by their activity.

Azure Sentinel High/Critical Alert Pattern Detection

Flags high-severity or critical alerts originating from Azure Sentinel that might point to coordinated attack behavior or serious security incidents requiring immediate investigation. This rule recognizes newly generated alerts rated High or Critical by Microsoft Sentinel that could represent active threats.

Azure Service Principal Credentials Added

Identifies additions of new credentials, such as certificates or secrets, to Azure service principals via Azure AD/Entra ID Audit Logs.

Security Context:
Attackers might add credentials to service principals to keep persistent access to victim Azure accounts. By hijacking an application that has permissions by adding rogue secrets or certificates, attackers can reach protected data and bypass MFA requirements. This technique is often used after initial compromise to establish long-term persistence.

Detection Logic:
This rule monitors AuditLogs for successful Add service principal operations, which signal that new credentials are being attached to service principals. Both certificate and secret additions are captured by this operation.

Investigation Steps:

  1. Identify the actor who added the credentials: Check log.propertiesInitiatedBy for the user or service principal

  2. Review the target service principal: Examine log.propertiesTargetResources for the affected service principal name and ID

  3. Verify if the action was authorized: Correlate with change management tickets

  4. Check service principal permissions: Review what resources this service principal can access

  5. Examine recent sign-in activity: Look for unusual authentication patterns using the service principal

  6. Review credential type: Determine if a certificate or secret was added via log.propertiesModifiedProperties

Recommended Actions:

  • If unauthorized, immediately revoke the newly added credentials

  • Review and rotate all credentials for the affected service principal

  • Audit all resources accessible by the service principal for signs of compromise

  • Enable alerts for future credential additions to critical service principals

  • Implement conditional access policies and privileged identity management

MITRE ATT&CK Reference: T1098.001 - Account Manipulation: Additional Cloud Credentials

Azure Documentation:

Azure Subscription Ownership Transfer Detected

Flags the transfer of Azure subscription ownership by tracking role assignment changes at the subscription level. This might indicate unauthorized access or insider threat activity.

Azure Subscription Permission Elevation via ElevateAccess

Identifies the MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION operation, which grants a Global Administrator access to all Azure subscriptions in the tenant. This is an extremely high-impact action that should be very rare and closely monitored.

AzureHound Reconnaissance Tool Detected

Flags the AzureHound user agent in Azure AD sign-in logs. AzureHound serves as the Azure AD data collector for BloodHound, used to enumerate every user, group, role, app, and relationship in the tenant for attack path analysis.

MFA Disabled for Privileged Azure AD User

Flags when Multi-Factor Authentication (MFA) is turned off for privileged users in Azure AD. This may indicate an attempt to weaken security controls for unauthorized access.

Multi-Factor Authentication Disabled for an Azure User

Identifies when multi-factor authentication (MFA) is turned off for an Azure AD/Entra ID user account via Audit Logs.

Security Context:
Multi-factor authentication is an essential security control that requires users to supply additional verification beyond a password alone. Turning off MFA for user accounts substantially reduces authentication security and is a frequent tactic adversaries use to keep persistent access. After MFA is disabled, attackers can sign in with only compromised credentials and avoid extra verification steps, which makes detection harder.

Detection Logic:
This rule watches AuditLogs for successful Disable Strong Authentication operations, which show the per-user MFA setting being disabled in Azure AD/Entra ID. This operation differs from Conditional Access MFA policies and reflects the legacy per-user MFA enforcement method.

Investigation Steps:

  1. Identify the disabler: Check log.propertiesInitiatedBy for who disabled MFA

  2. Identify affected user: Examine log.propertiesTargetResources for the user whose MFA was disabled

  3. Verify authorization: Confirm if the MFA disabling was part of legitimate administrative action

  4. Review user privilege: Determine if the affected user has elevated permissions (admins, privileged roles)

  5. Check timing: Analyze if MFA was disabled after suspicious authentication events

  6. Review authentication history: Look for failed authentication attempts before MFA disabling

  7. Check for compromise indicators: Search for unusual sign-in patterns, impossible travel, or risky sign-ins

  8. Examine subsequent logins: Monitor for authentication activity immediately after MFA disabling

  9. Review MFA methods: Check what MFA methods the user had registered before disabling

  10. Correlate with other events: Look for privilege escalation or data access after MFA disabling

Recommended Actions:

  • If unauthorized, immediately re-enable MFA for the affected user

  • Force password reset for the affected account

  • Review all authentication activity for the affected user

  • Check for compromised credentials using Azure AD Identity Protection

  • Revoke all active sessions for the affected user

  • Enable Conditional Access policies instead of per-user MFA for better control

  • Implement PIM approval workflows for modifying MFA settings

  • Enable alerts for MFA changes on privileged accounts

  • Audit accounts with permissions to modify user authentication settings

  • Review and restrict who can disable MFA (typically requires User Administrator or higher)

Modern MFA Management:

  • Per-user MFA (legacy): This detection targets the legacy per-user MFA setting

  • Conditional Access: Modern approach using policies instead of per-user settings

  • Authentication Methods Policy: A newer way to manage FIDO2, passwordless, and similar methods.

Organizations should transition from per-user MFA to Conditional Access policies to gain more granular control.

Common Attack Patterns:

  • Disabling MFA after compromising an administrator account

  • Removing MFA from privileged accounts for easier persistent access

  • Disabling MFA before credential harvesting or lateral movement

  • Insider threats removing MFA from their own accounts

  • Disabling MFA on service accounts to enable automated authentication attacks

Related Detections:

  • MFA method removal/changes

  • Conditional Access policy modifications

  • Authentication methods policy changes

  • Privileged role assignments without MFA

MITRE ATT&CK Reference: T1556 - Modify Authentication Process

Azure Documentation:

Flags when a user grants permissions to an Azure-registered application or when an administrator gives tenant-wide permissions to an application. An adversary might create an Azure-registered application that requests access to data including contact information, email, or documents. Consent grant attacks are frequently used in phishing campaigns where malicious OAuth applications deceive users into granting excessive permissions, enabling data exfiltration or unauthorized access to organizational resources.

Storage Account Public Access Enabled

Identifies when public access is turned on for Azure Storage Accounts, which may result in unauthorized data exposure.
This configuration change introduces a major security risk because it permits anonymous access to stored data.