Detection: O365 New MFA Method Registered

Updated Date: 2026-01-16 ID: 4e12db1f-f7c7-486d-8152-a221cad6ac2b Author: Mauricio Velazco, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a user account within Office 365. It leverages O365 audit logs to identify changes in MFA configurations. This activity is significant as it may indicate an attacker's attempt to maintain persistence on a compromised account. If confirmed malicious, the attacker could bypass existing security measures, solidify their access, and potentially escalate privileges or access sensitive data. Immediate verification and remediation are required to secure the affected account.

Search

 1`o365_management_activity`
 2Workload=AzureActiveDirectory
 3Operation="Update user."
 4
 5| eval propertyName = mvindex('ModifiedProperties{}.Name', 0)
 6
 7| search propertyName IN ("StrongAuthenticationMethod", "StrongAuthenticationPhoneAppDetail")
 8
 9| eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0)
10
11| eval newvalue = mvindex('ModifiedProperties{}.NewValue',0)
12
13| rex field=newvalue max_match=0 "(?i)(?<new_method_type>MethodType
14|DeviceName)"
15
16| rex field=oldvalue max_match=0 "(?i)(?<old_method_type>MethodType
17|DeviceName)"
18
19| eval count_new_method_type = coalesce(mvcount(new_method_type), 0)
20
21| eval count_old_method_type = coalesce(mvcount(old_method_type), 0)
22
23| where count_new_method_type > count_old_method_type
24
25| fillnull
26
27| stats earliest(_time) as firstTime
28        latest(_time) as lastTime
29        values(propertyName) as propertyName
30  by user newvalue oldvalue vendor_account
31     vendor_product dest signature src
32
33| `security_content_ctime(firstTime)`
34
35| `security_content_ctime(lastTime)`
36
37| `o365_new_mfa_method_registered_filter`

Data Source

Name	Platform	Sourcetype	Source
O365 Update user.	Other	`'o365:management:activity'`	`'o365'`

Macros Used

Name	Value
o365_management_activity	`sourcetype=o365:management:activity`
o365_new_mfa_method_registered_filter	`search *`

o365_new_mfa_method_registered_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1098.005	Device Registration	Persistence

Exploitation

Installation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.

Known False Positives

Users may register MFA methods legitimately, investigate and filter as needed.

Associated Analytic Story

Office 365 Persistence Mechanisms

Risk Based Analytics (RBA)

Risk Message:

A new MFA method was added for $user$

Risk Object	Risk Object Type	Risk Score	Threat Objects
user	user	30	No Threat Objects

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`o365`	`o365:management:activity`
Integration	✅ Passing	Dataset	`o365`	`o365:management:activity`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 8