Disabling Multi Factor Authentication

Title: Disabling Multi Factor Authentication
Status: test
Description:Detects disabling of Multi Factor Authentication.
References:
  -https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/
Author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)
Date: 2023-09-18
modified:None
Tags:

• -'attack.persistence'
• -'attack.credential-access'
• -'attack.defense-impairment'
• -'attack.t1556.006'

Logsource:

• service: audit
• product: m365

Detection:
  selection:
    Operation|contains: 'Disable Strong Authentication.'
  condition:selection
Falsepositives:
  -Unlikely
Level: high