Multi Factor Authentication Disabled For User Account

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•1•0•1

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.