Certificate-Based Authentication Enabled

calendar Oct 23, 2025 · attack.defense-evasion attack.credential-access attack.persistence attack.privilege-escalation attack.t1556  ·
Share on: linkedin copy

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Sigma rule (View on GitHub)

 1title: Certificate-Based Authentication Enabled
 2id: c2496b41-16a9-4016-a776-b23f8910dc58
 3status: test
 4description: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
 5references:
 6    - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
 7    - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
 8author: Harjot Shah Singh, '@cyb3rjy0t'
 9date: 2024-03-26
10tags:
11    - attack.defense-evasion
12    - attack.credential-access
13    - attack.persistence
14    - attack.privilege-escalation
15    - attack.t1556
16logsource:
17    product: azure
18    service: auditlogs
19detection:
20    selection:
21        OperationName: 'Authentication Methods Policy Update'
22        TargetResources.modifiedProperties|contains: 'AuthenticationMethodsPolicy'
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium

References

Related rules

to-top