mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
95 lines
3.8 KiB
YAML
95 lines
3.8 KiB
YAML
name: O365 Disable Strong Authentication.
|
|
id: 235381c4-382a-4183-b818-a51c3ce12187
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs the disabling of strong authentication (e.g., multi-factor authentication) for a user or group in Microsoft 365, including details about the affected accounts and the action initiator.
|
|
mitre_components:
|
|
- User Account Modification
|
|
- Group Modification
|
|
- Configuration Modification
|
|
- Application Log Content
|
|
source: o365
|
|
sourcetype: o365:management:activity
|
|
separator: Operation
|
|
separator_value: Disable Strong Authentication.
|
|
supported_TA:
|
|
- name: Splunk Add-on for Microsoft Office 365
|
|
url: https://splunkbase.splunk.com/app/4055
|
|
version: 6.0.2
|
|
fields:
|
|
- _time
|
|
- ActorContextId
|
|
- ActorIpAddress
|
|
- Actor{}.ID
|
|
- Actor{}.Type
|
|
- AzureActiveDirectoryEventType
|
|
- ClientIP
|
|
- CreationTime
|
|
- ExtendedProperties{}.Name
|
|
- ExtendedProperties{}.Value
|
|
- Id
|
|
- InterSystemsId
|
|
- IntraSystemId
|
|
- ModifiedProperties{}.Name
|
|
- ModifiedProperties{}.NewValue
|
|
- ModifiedProperties{}.OldValue
|
|
- ObjectId
|
|
- Operation
|
|
- OrganizationId
|
|
- RecordType
|
|
- ResultStatus
|
|
- SupportTicketId
|
|
- TargetContextId
|
|
- Target{}.ID
|
|
- Target{}.Type
|
|
- UserId
|
|
- UserKey
|
|
- UserType
|
|
- Version
|
|
- Workload
|
|
- additionalDetails
|
|
- app
|
|
- authentication_service
|
|
- command
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dest_name
|
|
- dvc
|
|
- event_type
|
|
- extendedAuditEventCategory
|
|
- extended_properties
|
|
- host
|
|
- index
|
|
- linecount
|
|
- object
|
|
- punct
|
|
- record_type
|
|
- signature
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- status
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- user_id
|
|
- user_type
|
|
- vendor_account
|
|
- vendor_product
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- src
|
|
- vendor_account
|
|
- vendor_product
|
|
example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2020-12-15T22:35:20", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "a5aea9c5-b879-495a-b764-119b2bd54d80", "InterSystemsId": "9d18b521-23df-4130-99e2-1ff2eee13333", "IntraSystemId": "7d96ab40-6e16-48e5-bf78-677c89683775", "ModifiedProperties": [{"Name": "StrongAuthenticationRequirement", "NewValue": "[]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2020-12-15T20:47:57+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationRequirement", "OldValue": ""}], "ObjectId": "rodsoto@rodsoto.onmicrosoft.com", "Operation": "Disable Strong Authentication.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}'
|