T1556.009 — Conditional Access Policies

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: IaaS, Identity Provider

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (2)

T1556.009 Modify Authentication Process: Conditional Access Policies

title: "T1556.009 Modify Authentication Process: Conditional Access Policies"
id: 8c7172d4-1681-450e-9c0f-7f3f7022608d
description: 'Detect Conditional Access Policy Modification in Identity and Cloud Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredIAMConditions, TimeWindow, PrivilegedAccounts.'
references:
  - https://attack.mitre.org/techniques/T1556/009
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.009

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'organizations.amazonaws.com'
    eventName:
      - 'UpdatePolicy'
      - 'DeletePolicy'
      - 'DetachPolicy'

  condition: selection

falsepositives:
  - Scheduled service control policy updates by cloud governance teams during guardrail maintenance; confirming that a specific IAM condition clause was stripped from a policy would require diffing the before and after policy documents rather than a single event.

level: high

T1556.009 Modify Authentication Process: Conditional Access Policies

title: "T1556.009 Modify Authentication Process: Conditional Access Policies"
id: 3e6b5aeb-85ce-4720-b51b-bc48142bf004
description: 'Detect Conditional Access Policy Modification in Identity and Cloud Platforms. (Data Component: Active Directory Object Modification; baseline tier: fallback.) Tune using: TargetedApplications, RiskThresholds, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1556/009
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.009

logsource:
  product: azure
  service: activity

detection:
  selection:
    OperationName:
      - 'Microsoft.Authorization/policyAssignments/write'
      - 'Microsoft.Authorization/policyAssignments/delete'

  condition: selection

falsepositives:
  - Cloud governance teams updating Azure Policy assignments as part of a scheduled compliance baseline update.

level: high

Related sub-techniques

Explore