audit

Disabling Multi Factor Authentication

Aug 14, 2025 · attack.persistence attack.defense-evasion attack.credential-access attack.t1556.006 ·

Share on:

Detects disabling of Multi Factor Authentication.

New Federated Domain Added

Aug 14, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.002 ·

Share on:

Detects the addition of a new Federated Domain.

Azure Login Bypassing Conditional Access Policies

Jan 19, 2025 · attack.defense-evasion attack.t1078 ·

Share on:

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.