• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Account MFA Modifications

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•1•0•39

    'Identifies modifications to user's MFA settings. An attacker could use access to modify MFA settings to bypass MFA requirements or maintain persistence.

    Microsoft Sentinel (KQL)

    Tags

    T1556.006 - Multi-Factor AuthenticationTA0005 - Defense EvasionTA0003 - PersistenceTA0006 - Credential AccessUser Account ModifiedMultifactor Authentication RequestAzureOffice 365Azure Activity LogsM365 Unified Audit Logkqltactic:DefenseEvasiontactic:Persistencetechnique:T1556.006

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?