Techniques
Sample rules
GitHub MFA Requirement Disabled
- source: elastic
- technicques:
- T1556
- T1562
Description
Detects when the two-factor authentication (2FA) requirement is disabled for a GitHub organization or enterprise. Removing the requirement downgrades every member in scope to password-only authentication and allows new members to be added without 2FA. Following an account takeover, an adversary may disable the requirement to preserve password-based access, reduce friction for enrolling attacker-controlled accounts, and lower the organization’s overall account-takeover resistance, making this a high-impact identity-control change.
Detection logic
from logs-github.audit-* metadata _id, _index, _version
| where
event.module == "github" and data_stream.dataset == "github.audit"
and event.action in ("business.disable_two_factor_requirement", "org.disable_two_factor_requirement")
| keep
_id,
_index,
_version,
@timestamp,
event.action,
user.name,
github.org,
github.repo,
github.actor_ip,
github.hashed_token,
github.programmatic_access_type,
github.user_agent,
github.business