T1556.006 — Multi-Factor Authentication

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (7)

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: 91ec2ad1-b5c9-477f-9002-7596fd3118ae
description: 'True MFA/Conditional Access tampering (e.g. disabling Azure AD MFA, excluding users from Conditional Access policies) is a cloud control-plane action and is not observable in Windows Security or Sysmon telemetry at all. As the closest on-prem Windows-observable proxy, this rule detects Directory Service attribute changes (Security EventID 5136) to userAccountControl, msDS-SupportedEncryptionTypes, or msDS-KeyCredentialLink, reflecting local weakening of an account authentication mechanism (e.g. removing a smart-card-required flag, adding a shadow-credential key) rather than the original cloud-MFA scenario. (Data Component: Active Directory Object Modification; baseline tier: windows-eventid.) Tune using: WatchedAttributes, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName:
      - 'userAccountControl'
      - 'msDS-SupportedEncryptionTypes'
      - 'msDS-KeyCredentialLink'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate AD administration changing these attributes for account provisioning or Windows Hello for Business key enrollment; requires Directory Service Changes auditing (SACL) enabled on AD objects; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with attribute/OU allowlists if noise remains.

level: medium

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: f37cd697-9f21-41a6-bcb0-ce538e7c0ec8
description: 'Detect MFA Modification or Disabling Across Platforms via two independent Linux-observable proxies: (1) an auditd PATH record showing a write/normal-access under /etc/pam.d/ (the directory holding per-service PAM stacks where MFA modules are wired in), and (2) an EXECVE record whose captured argv/command-line references pam_exec.so or pam_script (e.g. a shell one-liner using echo or sed to insert a malicious PAM module line). Module names such as pam_exec.so are config-file content, not part of a filename, so they can only be observed via process argv that happens to carry that content, never by ANDing two substring filters on the same PATH name field as the previous version did, which could never fire. Tune using: MFAHooks, PamDPathAllowList.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  product: linux
  service: auditd

detection:
  selection_path_write:
    type: PATH
    nametype: NORMAL
    name|contains: '/etc/pam.d/'
  selection_module_ref:
    type: EXECVE
    a2|contains:
      - 'pam_exec.so'
      - 'pam_script'

  condition: 1 of selection_*

falsepositives:
  - Legitimate PAM stack maintenance (adding pam_google_authenticator, editing sshd/system-auth) by admins or configuration-management tools also touches /etc/pam.d/ and may legitimately reference pam_exec.so; correlate with change-management windows and known-good module hashes.

level: high

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: f9d72cf3-1fa8-489d-ad3f-57b60ec4a22d
description: 'Detect MFA Modification or Disabling Across Platforms. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedPluginPaths.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains: '/Library/Security/SecurityAgentPlugins/'

  condition: selection

falsepositives:
  - Multi-factor authentication enrollment or agent updates pushed through approved MDM profiles; unified log does not expose which MFA factor was altered.

level: medium

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: c6e1cde5-5f8f-464a-afcc-dccb525b8461
description: 'Detect MFA Modification or Disabling Across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredServices.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'iam.amazonaws.com'
    eventName:
      - 'DeactivateMFADevice'
      - 'DeleteVirtualMFADevice'

  condition: selection

falsepositives:
  - User-initiated MFA device replacement after losing a hardware token, carried out through a verified support process.

level: high

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: 38af8edf-b5c9-4f2e-b929-ebb4122a35d0
description: 'Detect MFA Modification or Disabling Across Platforms. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: AcceptedFactors.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-03-30
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  product: saas
  service: zoom

detection:
  selection:
    category_type: 'User'
    action|contains: 'two factor'

  condition: selection

falsepositives:
  - A user or admin legitimately re-enrolling a lost or replaced MFA device through the normal self-service account recovery flow.

level: high

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: 0adddf67-b71f-42f7-84b7-233baee904bb
description: 'Detect MFA Modification or Disabling Across Platforms. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PrivilegedRoles.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    AppDisplayName: 'Azure Active Directory PowerShell'
    ResultType: '0'
  selection_priv:
    AuthenticationRequirement: 'singleFactorAuthentication'
  condition: selection and selection_priv

falsepositives:
  - Legitimate privileged administrator sessions from break glass accounts intentionally exempted from MFA enforcement.

level: high

title: "T1556.006 Modify Authentication Process: Multi-Factor Authentication"
id: 9c39ed8b-87df-42c3-9f7d-b1510f1b4e48
description: 'Detect MFA Modification or Disabling Across Platforms. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MonitoredPolicies.'
references:
  - https://attack.mitre.org/techniques/T1556/006
author: Shahrukh Khan
date: 2026-04-01
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.006

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Set-MailboxJunkEmailConfiguration'
      - 'Disable-InboxRule'
      - 'Set-AdminAuditLogConfig'
    Workload: 'Exchange'

  condition: selection

falsepositives:
  - Exchange administrators legitimately disabling audit log configuration during a scheduled maintenance window.

level: high

Related sub-techniques

• T1556.008 Network Provider DLL
• T1556.001 Domain Controller Authentication
• T1556.003 Pluggable Authentication Modules
• T1556.004 Network Device Authentication
• T1556.002 Password Filter DLL
• T1556.005 Reversible Encryption
• T1556.009 Conditional Access Policies
• T1556.007 Hybrid Identity

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1556.006 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan