MFA was disabled for an Azure identity

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Hour
Required Data	Requires: AzureAD Audit Log
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Defense Evasion (TA0005) Persistence (TA0003)
ATT&CK Technique	Modify Authentication Process (T1556)
Severity	Low

MFA was disabled for the user.

This allows the attacker to connect using this account without the need for the additional layer of authentication.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

MFA was disabled for the user from a new country.

This allows the attacker to connect using this account without the need for the additional layer of authentication.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

MFA was disabled for the user.

This allows the attacker to connect using this account without the need for the additional layer of authentication.