Techniques
Sample rules
Roles Activation Doesn’t Require MFA
- source: sigma
- technicques:
- t1078
Description
Identifies when a privilege role can be activated without performing mfa.
Detection logic
condition: selection
selection:
riskEventType: noMfaOnRoleActivationAlertIncident