LoFP / if a mfa reset or deactivated was performed by a system administrator.

Techniques

• t1556
• t1556.006

Sample rules

Okta MFA Reset or Deactivated

• source: sigma
• technicques:
  • t1556
  • t1556.006

Description

Detects when an attempt at deactivating or resetting MFA.

Detection logic

condition: selection
selection:
  eventtype:
  - user.mfa.factor.deactivate
  - user.mfa.factor.reset_all