mfa policies may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

t1531
t1556
google_workspace
elastic

Techniques

T1531
T1556

Sample rules

Google Workspace MFA Enforcement Disabled For Organization

source: elastic
technicques:
- T1531
- T1556

Description

Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate credential abuse at scale, and reduce friction for follow-on account takeover across the domain.

Detection logic

data_stream.dataset:google_workspace.admin
  and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION)
  and google_workspace.admin.new_value:false