HUNT 23 MFA Auth Method Changes

Query

// Hunt     : Hunt - MFA / Authentication Method Registration Changes (30d)
// Tactics  : Persistence, CredentialAccess
// MITRE    : T1098.005 (Device Registration), T1556.006 (MFA)
// Purpose  : Surfaces registration/removal of authentication methods (phone, authenticator,
//            FIDO2, TAP, email). Attackers who phish a session frequently register their OWN
//            MFA method to establish durable access, or remove the victim's methods. Focus on
//            events where the initiator differs from the target (admin-on-behalf-of), or a
//            burst of self-service changes shortly after a risky sign-in.
//==========================================================================================

let Window = 30d;
let MethodOps = dynamic([
    "User registered security info",
    "User changed default security info",
    "User deleted security info",
    "Admin registered security info",
    "Admin updated security info",
    "Admin deleted security info",
    "User registered all required security info",
    "Register security information",
    "Reset security information"
]);
AuditLogs
| where TimeGenerated > ago(Window)
| where LoggedByService in~ ("Authentication Methods", "Self-service Password Management", "Core Directory")
| where OperationName has_any (MethodOps)
| extend Initiator = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatorId = tostring(InitiatedBy.user.id)
| extend InitiatorIP = tostring(InitiatedBy.user.ipAddress)
| extend TargetUPN = tostring(TargetResources[0].userPrincipalName)
| extend TargetId = tostring(TargetResources[0].id)
| extend MethodDetail = tostring(TargetResources[0].modifiedProperties)
| extend ActorIsNotTarget = isnotempty(InitiatorId) and isnotempty(TargetId) and InitiatorId != TargetId
| project TimeGenerated, OperationName, Result, Initiator, InitiatorIP, TargetUPN,
    ActorIsNotTarget, MethodDetail, CorrelationId
| order by ActorIsNotTarget desc, TimeGenerated desc

Explanation

This query is designed to identify suspicious changes to authentication methods within a 30-day window. It focuses on events where authentication methods (like phone, authenticator apps, FIDO2, TAP, or email) are registered or removed, which could indicate potential security threats. Here's a simple breakdown:

Time Frame: The query looks at logs from the past 30 days.
Operations Monitored: It tracks specific operations related to security info changes, such as registration, deletion, or updates by both users and admins.
Data Source: It pulls data from logs related to "Authentication Methods", "Self-service Password Management", and "Core Directory".
Key Fields Extracted:
- Initiator: Who initiated the change (could be a user or an application).
- Initiator IP: The IP address of the initiator.
- Target User: The user whose authentication methods were changed.
- Method Details: Specific details about what was changed.
Suspicious Activity Focus:
- It highlights cases where the person making the change (initiator) is different from the person whose account is being changed (target), which might indicate unauthorized access.
- It also looks for bursts of self-service changes following a risky sign-in, which could suggest an attacker is trying to establish persistent access.
Output: The results are sorted to prioritize cases where the initiator is not the target, showing the most recent events first. This helps in quickly identifying potential security incidents.