// Detection

MFA method removed

An authenticator unenrolled from an account. Frequently the first action after a takeover, to keep access once the password is reset.

CriticalInvestigating0alerts raisedSignature

Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is MFA_METHOD_REMOVED

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "MFA_METHOD_REMOVED"
    }
  ]
}

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

NameSeverity

Description

CategoryATT&CK tacticTechnique

Logic

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

What this rule has actually caught.

Armed, but nothing in the retained window has matched it.