T1556 — Modify Authentication Process

# T1556 - Modify Authentication Process

## SOC Recommendation
Investigate Modify Authentication Process activity in the context of Defense Impairment/Persistence/Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let lookback              = 1d;
let userRingThreshold     = 3;   // distinct target users sharing one phone number to call it a "burner pool"
let actorRingThreshold    = 3;   // distinct target users touched by one actor to call it "mass registration"
let TrustedRanges =
    _GetWatchlist("TrustedVPNRanges")
    | extend VPNRange = tostring(column_ifexists("SearchKey", column_ifexists("Subnet", "")))
    | where isnotempty(VPNRange)
    | extend VPNRange = trim(" ", VPNRange)
    | extend VPNRange = iff(VPNRange has "/", VPNRange, strcat(VPNRange, "/32"))
    | summarize by VPNRange;
// --- Premium-rate calling-code prefixes (analyst-maintained watchlist) ---
// "PremiumRateNumberRanges" (Analytic Rules/Watchlists/PremiumRateNumberRanges.csv)
// is seeded from two sources:
//   1. The satellite/International Network ranges (881, 882, 883, 870) that
//      are consistently documented top IRSF destinations regardless of org.
//   2. Microsoft Entra ID's own published list of country/region codes that
//      require support-ticket opt-in for MFA SMS/voice specifically due to
//      elevated telephony/IRSF fraud risk (Microsoft Learn:
//      "Telephony Fraud Protections and Throttles" / concept-mfa-regional-opt-in).
// TUNING REQUIRED before enabling: source #2 is intentionally broad (Microsoft's
// default-block posture covers ~180 countries, including ones with large
// legitimate business populations e.g. Belgium, Netherlands, Israel, Hong Kong).
// Prune the watchlist down to countries where THIS org has no legitimate users
// or customers, or false positives will be frequent. Empty/pruned watchlist
// simply yields 0 PremiumRateMatch hits - the other three signals still apply.
let premiumPrefixSet =
    toscalar(
        _GetWatchlist("PremiumRateNumberRanges")
        | extend Prefix = trim(@"[+\s]", tostring(column_ifexists("Prefix", column_ifexists("SearchKey", ""))))
        | where isnotempty(Prefix)
        | summarize make_set(Prefix)
    );
// --- Approved shared MFA numbers (e.g. help-desk break-glass line) ---
// Add E.164 numbers here that are LEGITIMATELY shared/registered across many
// accounts or providers by design, to suppress the ring/cross-provider
// signals for just that number.
let approvedSharedNumbers = dynamic([]);
// =========================== Entra ID (Microsoft) ===========================
let entraPhoneEvents =
    AuditLogs
    | where TimeGenerated >= ago(lookback)
    | where Category == "UserManagement"
    | where OperationName has_any ("security info", "Update user", "authentication method")
    | mv-expand TargetResource = TargetResources
    | mv-expand ModifiedProp = TargetResource.modifiedProperties
    | extend PropName = tostring(ModifiedProp.displayName)
    | where PropName has "phone"
    | extend NewValueRaw = tostring(ModifiedProp.newValue)
    // newValue is JSON-encoded: a quoted string ("\"+15555550123\"") or an
    // array of strings for multi-valued properties (Business Phones).
    // Strip brackets/quotes and split on comma to cover both shapes.
    | extend NewValueClean = replace_string(trim(@"[\[\]\s]", NewValueRaw), '"', "")
    | mv-expand PhoneRaw = split(NewValueClean, ",") to typeof(string)
    | where isnotempty(PhoneRaw) and PhoneRaw !in ("null", "")
    | extend ActorUPN = tolower(coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)))
    | extend ActorIP  = tostring(InitiatedBy.user.ipAddress)
    | extend TargetUPN = tolower(tostring(TargetResource.userPrincipalName))
    | where isnotempty(TargetUPN)
    | project TimeGenerated, Provider = "EntraID", ActorUPN, ActorIP, TargetUPN, PhoneRaw,
              EventType = OperationName, PropName;
// ================================= Okta ====================================
// See "IMPORTANT" note above - validate table/column names for your tenant.
let oktaPhoneEvents =
    union isfuzzy=true OktaSystemLog,
    (datatable(TimeGenerated:datetime, uuid:string, eventType:string, actor:dynamic, client:dynamic, target:dynamic)[])
    | where TimeGenerated >= ago(lookback)
    | where eventType has_any ("user.mfa.factor.activate", "user.mfa.factor.update", "user.factor.activate", "user.mfa.factor.enroll")
    | mv-expand Target = target
    | extend TType = tostring(Target.type), TAlt = tostring(Target.alternateId)
    // Collapse the mv-expand back to one row per source event so we can pull
    // BOTH the enrolled phone (UserFactor) and the target user (User) out of
    // the same target[] array without a row-multiplying join.
    | summarize
            PhoneRawArr  = make_set_if(TAlt, TType == "UserFactor"),
            TargetUpnArr = make_set_if(TAlt, TType == "User")
        by TimeGenerated, EventKey = coalesce(uuid, strcat(tostring(TimeGenerated), tostring(actor.alternateId))),
           eventType, ActorUPN = tolower(tostring(actor.alternateId)), ActorIP = tostring(client.ipAddress)
    | extend PhoneRawFull = tostring(PhoneRawArr[0])
    | where isnotempty(PhoneRawFull)
    // Okta factor alternateId is often prefixed, e.g. "sms:+15555550123".
    | extend PhoneRaw = extract(@'(\+?\d[\d\-\s]{5,})', 1, PhoneRawFull)
    | extend TargetUPN = tolower(tostring(TargetUpnArr[0]))
    | where isnotempty(PhoneRaw) and isnotempty(TargetUPN)
    | project TimeGenerated, Provider = "Okta", ActorUPN, ActorIP, TargetUPN, PhoneRaw,
              EventType = eventType, PropName = "phoneFactor";
// =============================== Correlate ==================================
let allEvents =
    union isfuzzy=true entraPhoneEvents, oktaPhoneEvents
    | evaluate ipv4_lookup(TrustedRanges, ActorIP, VPNRange, false)
    | extend ActorIsTrustedVPNIP = isnotempty(VPNRange)
    | extend PhoneNormalized = replace_regex(PhoneRaw, @"[^\d+]", "")
    | where isnotempty(PhoneNormalized) and PhoneNormalized != "+"
    | extend Digits = trim_start(@"\+", PhoneNormalized)
    | extend IsPremiumRate = array_length(premiumPrefixSet) > 0 and (
            set_has_element(premiumPrefixSet, substring(Digits, 0, 1))
         or set_has_element(premiumPrefixSet, substring(Digits, 0, 2))
         or set_has_element(premiumPrefixSet, substring(Digits, 0, 3))
         or set_has_element(premiumPrefixSet, substring(Digits, 0, 4)))
    | extend IsApprovedNumber = set_has_element(approvedSharedNumbers, PhoneNormalized)
    | project-away VPNRange;
// Ring signal 1: same phone number registered across multiple providers.
let crossProviderPhones =
    allEvents
    | summarize DistinctProviders = dcount(Provider), Providers = make_set(Provider, 4) by PhoneNormalized
    | where DistinctProviders >= 2;
// Ring signal 2: same phone number registered for many distinct target users.
let sharedPhones =
    allEvents
    | summarize DistinctUsersForPhone = dcount(TargetUPN), UsersForPhone = make_set(TargetUPN, 32) by PhoneNormalized
    | where DistinctUsersForPhone >= userRingThreshold;
// Ring signal 3: same actor registering MFA phones for many distinct targets.
let massRegistrationActors =
    allEvents
    | where isnotempty(ActorUPN)
    | summarize DistinctTargetsByActor = dcount(TargetUPN), TargetsByActor = make_set(TargetUPN, 32) by ActorUPN
    | where DistinctTargetsByActor >= actorRingThreshold;
allEvents
| join kind=leftouter (crossProviderPhones) on PhoneNormalized
| join kind=leftouter (sharedPhones) on PhoneNormalized
| join kind=leftouter (massRegistrationActors) on ActorUPN
| extend DistinctProviders      = coalesce(DistinctProviders, 1),
         DistinctUsersForPhone  = coalesce(DistinctUsersForPhone, 1),
         DistinctTargetsByActor = coalesce(DistinctTargetsByActor, 1)
| extend CrossProviderReuse     = DistinctProviders >= 2,
         PhoneReusedAcrossUsers = DistinctUsersForPhone >= userRingThreshold,
         ActorMassRegistration  = DistinctTargetsByActor >= actorRingThreshold
| where not(IsApprovedNumber)
| where IsPremiumRate or CrossProviderReuse or PhoneReusedAcrossUsers or ActorMassRegistration
| extend RiskScore = toint(IsPremiumRate) * 2
                    + toint(CrossProviderReuse) * 2
                    + toint(PhoneReusedAcrossUsers) * 2
                    + toint(ActorMassRegistration) * 1
| extend Signals = set_difference(
        pack_array(
            iff(IsPremiumRate,            "PremiumRateMatch",       ""),
            iff(CrossProviderReuse,       "CrossProviderReuse",     ""),
            iff(PhoneReusedAcrossUsers,   "PhoneReusedAcrossUsers", ""),
            iff(ActorMassRegistration,    "ActorMassRegistration",  "")),
        dynamic([""]))
| extend Severity = case(
        IsPremiumRate and CrossProviderReuse, "Critical",
        RiskScore >= 4,                       "Critical",
        RiskScore >= 2,                       "High",
        "Medium")
| extend AccountName = tostring(split(TargetUPN, "@")[0]),
         UPNSuffix   = tostring(split(TargetUPN, "@")[1])
| project TimeGenerated, Provider, EventType, Severity, RiskScore, Signals,
          TargetUPN, AccountName, UPNSuffix, ActorUPN, ActorIP, ActorIsTrustedVPNIP,
          PhoneRaw, PhoneNormalized, IsPremiumRate,
          DistinctProviders, CrossProviderReuse,
          DistinctUsersForPhone, PhoneReusedAcrossUsers,
          DistinctTargetsByActor, ActorMassRegistration
| extend timestamp = TimeGenerated, AccountCustomEntity = TargetUPN, IPCustomEntity = ActorIP
| order by Severity asc, RiskScore desc, TimeGenerated desc
```
```kql
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.9"
  or tostring(ComplianceSecurityControlId) == "IAM.9"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN
```
```kql
//Malicious Phishing Network Indicators - Block Recommended
let timeFrame= 5m;
CyfirmaIndicators_CL 
| where ConfidenceScore >= 80
    and TimeGenerated between (ago(timeFrame) .. now())
    and pattern !contains 'file:hashes' and RecommendedActions has 'Block' and Roles has 'Phishing'
| extend IPv4 = extract(@"ipv4-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend IPv6 = extract(@"ipv6-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend URL = extract(@"url:value\s*=\s*'([^']+)'", 1, pattern)
| extend Domain = extract(@"domain-name:value\s*=\s*'([^']+)'", 1, pattern)
| extend parsed = parse_json(extensions)
| extend extensionKeys = bag_keys(parsed)
| mv-expand extensionKeys
| extend extensionKeyStr = tostring(extensionKeys)
| extend ext = parsed[extensionKeyStr]
| extend props = ext.properties
| extend 
    extension_id = extensionKeyStr,
    ASN_Owner = props.asn_owner,
    ASN = props.asn,
    ProviderName = 'CYFIRMA',
    ProductName = 'DeCYFIR/DeTCT'
| project
    IPv4,
    IPv6,
    URL,
    Domain,
    ThreatActors,
    RecommendedActions,
    Sources,
    Roles,
    Country,
    IPAbuse,
    name,
    Description,
    ConfidenceScore,
    IndicatorID,
    created,
    modified,
    valid_from,
    Tags,
    ThreatType,
    TimeGenerated,
    SecurityVendors,
    ProductName,
    ProviderName
```

## Escalation Criteria
- Modify Authentication Process activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1556.json
• /api/recommendations/T1556.json
• /api/d3fend/T1556.json
• /api/mappings/T1556.json
• /api/confluence/T1556.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1556.json

Response:

{
  "technique_id": "T1556",
  "name": "Modify Authentication Process",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Defense Impairment",
    "Persistence",
    "Credential Access"
  ],
  "platforms": [
    "IaaS",
    "Identity Provider",
    "Linux",
    "macOS",
    "Network Devices",
    "Office Suite",
    "SaaS",
    "Windows"
  ],
  "summary": "Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials...",
  "soc_recommendation": "Investigate Modify Authentication Process activity in the context of Defense Impairment/Persistence/Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed modify authentication process activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"MFA Fraudulent Registration - Premium Rate Number Abuse (Multi-IdP)\" -- Detects \"MFA toll fraud\" / International Revenue Share Fraud (IRSF) via authentication registration: an attacker (often using a compromised or throwaway/self-service-registered account) enrolls a premium-rate phone number as an SMS/voice MFA method. Every OTP text or voice call the provider then sends to that number generates revenue for the fraudster's telco partner - the \"MFA\" system itself becomes the fraud engine, no credential theft required beyond initial account access. Correlates across BOTH Microsoft Entra ID (AuditLogs) and Okta (System Log), normalized to a common schema, because the strongest signal is the SAME phone number (or actor) being used to register MFA in MULTIPLE, otherwise-unrelated identity providers within the org - legitimate users essentially never do this; fraud rings and shared burner-number pools do. Fires when at least one of these signals is present:   * PremiumRateMatch   : registered number's calling-code prefix matches                          the analyst-maintained \"PremiumRateNumberRanges\"                          watchlist (populate from your telco/anti-fraud                          feed - left empty by default, see below).   * CrossProviderReuse : the same phone number registered as an MFA method                          in 2+ distinct providers (EntraID + Okta) within                          the window - the multi-IdP fraud-ring fingerprint.   * PhoneReusedAcrossUsers : the same phone number registered for N+                          distinct target users (a \"burner number pool\"                          shared by a fraud farm; real users don't share                          MFA phones).   * ActorMassRegistration : the same actor/session registers MFA phones                          for N+ distinct target users in the window                          (compromised admin / SSPR abuse / scripted farm). IMPORTANT - Okta section is a best-effort normalizer:   The exact custom-table and column names for Okta System Log depend on   how your tenant's Okta data connector is configured (commonly ingested   as \"OktaSystemLog\" via the Codeless Connector, or \"Okta_CL\" on older   connectors). Validate the table/column names below against what is   actually in YOUR workspace (`search *` on a sample factor-enrollment   event) before enabling this rule, and adjust the `oktaPhoneEvents` block   accordingly. The EntraID half runs safely regardless."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CA-008 — MFA Fraudulent Registration - Premium Rate Number Abuse (Multi-IdP)",
        "description": "Detects \"MFA toll fraud\" / International Revenue Share Fraud (IRSF) via authentication registration: an attacker (often using a compromised or throwaway/self-service-registered account) enrolls a premium-rate phone number as an SMS/voice MFA method. Every OTP text or voice call the provider then sends to that number generates revenue for the fraudster's telco partner - the \"MFA\" system itself becomes the fraud engine, no credential theft required beyond initial account access. Correlates across BOTH Microsoft Entra ID (AuditLogs) and Okta (System Log), normalized to a common schema, because the strongest signal is the SAME phone number (or actor) being used to register MFA in MULTIPLE, otherwise-unrelated identity providers within the org - legitimate users essentially never do this; fraud rings and shared burner-number pools do. Fires when at least one of these signals is present:   * PremiumRateMatch   : registered number's calling-code prefix matches                          the analyst-maintained \"PremiumRateNumberRanges\"                          watchlist (populate from your telco/anti-fraud                          feed - left empty by default, see below).   * CrossProviderReuse : the same phone number registered as an MFA method                          in 2+ distinct providers (EntraID + Okta) within                          the window - the multi-IdP fraud-ring fingerprint.   * PhoneReusedAcrossUsers : the same phone number registered for N+                          distinct target users (a \"burner number pool\"                          shared by a fraud farm; real users don't share                          MFA phones).   * ActorMassRegistration : the same actor/session registers MFA phones                          for N+ distinct target users in the window                          (compromised admin / SSPR abuse / scripted farm). IMPORTANT - Okta section is a best-effort normalizer:   The exact custom-table and column names for Okta System Log depend on   how your tenant's Okta data connector is configured (commonly ingested   as \"OktaSystemLog\" via the Codeless Connector, or \"Okta_CL\" on older   connectors). Validate the table/column names below against what is   actually in YOUR workspace (`search *` on a sample factor-enrollment   event) before enabling this rule, and adjust the `oktaPhoneEvents` block   accordingly. The EntraID half runs safely regardless. (Source: Bell Integration baseline detection library, mapped via sub-technique T1556.006.)",
        "query": "let lookback              = 1d;\nlet userRingThreshold     = 3;   // distinct target users sharing one phone number to call it a \"burner pool\"\nlet actorRingThreshold    = 3;   // distinct target users touched by one actor to call it \"mass registration\"\nlet TrustedRanges =\n    _GetWatchlist(\"TrustedVPNRanges\")\n    | extend VPNRange = tostring(column_ifexists(\"SearchKey\", column_ifexists(\"Subnet\", \"\")))\n    | where isnotempty(VPNRange)\n    | extend VPNRange = trim(\" \", VPNRange)\n    | extend VPNRange = iff(VPNRange has \"/\", VPNRange, strcat(VPNRange, \"/32\"))\n    | summarize by VPNRange;\n// --- Premium-rate calling-code prefixes (analyst-maintained watchlist) ---\n// \"PremiumRateNumberRanges\" (Analytic Rules/Watchlists/PremiumRateNumberRanges.csv)\n// is seeded from two sources:\n//   1. The satellite/International Network ranges (881, 882, 883, 870) that\n//      are consistently documented top IRSF destinations regardless of org.\n//   2. Microsoft Entra ID's own published list of country/region codes that\n//      require support-ticket opt-in for MFA SMS/voice specifically due to\n//      elevated telephony/IRSF fraud risk (Microsoft Learn:\n//      \"Telephony Fraud Protections and Throttles\" / concept-mfa-regional-opt-in).\n// TUNING REQUIRED before enabling: source #2 is intentionally broad (Microsoft's\n// default-block posture covers ~180 countries, including ones with large\n// legitimate business populations e.g. Belgium, Netherlands, Israel, Hong Kong).\n// Prune the watchlist down to countries where THIS org has no legitimate users\n// or customers, or false positives will be frequent. Empty/pruned watchlist\n// simply yields 0 PremiumRateMatch hits - the other three signals still apply.\nlet premiumPrefixSet =\n    toscalar(\n        _GetWatchlist(\"PremiumRateNumberRanges\")\n        | extend Prefix = trim(@\"[+\\s]\", tostring(column_ifexists(\"Prefix\", column_ifexists(\"SearchKey\", \"\"))))\n        | where isnotempty(Prefix)\n        | summarize make_set(Prefix)\n    );\n// --- Approved shared MFA numbers (e.g. help-desk break-glass line) ---\n// Add E.164 numbers here that are LEGITIMATELY shared/registered across many\n// accounts or providers by design, to suppress the ring/cross-provider\n// signals for just that number.\nlet approvedSharedNumbers = dynamic([]);\n// =========================== Entra ID (Microsoft) ===========================\nlet entraPhoneEvents =\n    AuditLogs\n    | where TimeGenerated >= ago(lookback)\n    | where Category == \"UserManagement\"\n    | where OperationName has_any (\"security info\", \"Update user\", \"authentication method\")\n    | mv-expand TargetResource = TargetResources\n    | mv-expand ModifiedProp = TargetResource.modifiedProperties\n    | extend PropName = tostring(ModifiedProp.displayName)\n    | where PropName has \"phone\"\n    | extend NewValueRaw = tostring(ModifiedProp.newValue)\n    // newValue is JSON-encoded: a quoted string (\"\\\"+15555550123\\\"\") or an\n    // array of strings for multi-valued properties (Business Phones).\n    // Strip brackets/quotes and split on comma to cover both shapes.\n    | extend NewValueClean = replace_string(trim(@\"[\\[\\]\\s]\", NewValueRaw), '\"', \"\")\n    | mv-expand PhoneRaw = split(NewValueClean, \",\") to typeof(string)\n    | where isnotempty(PhoneRaw) and PhoneRaw !in (\"null\", \"\")\n    | extend ActorUPN = tolower(coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)))\n    | extend ActorIP  = tostring(InitiatedBy.user.ipAddress)\n    | extend TargetUPN = tolower(tostring(TargetResource.userPrincipalName))\n    | where isnotempty(TargetUPN)\n    | project TimeGenerated, Provider = \"EntraID\", ActorUPN, ActorIP, TargetUPN, PhoneRaw,\n              EventType = OperationName, PropName;\n// ================================= Okta ====================================\n// See \"IMPORTANT\" note above - validate table/column names for your tenant.\nlet oktaPhoneEvents =\n    union isfuzzy=true OktaSystemLog,\n    (datatable(TimeGenerated:datetime, uuid:string, eventType:string, actor:dynamic, client:dynamic, target:dynamic)[])\n    | where TimeGenerated >= ago(lookback)\n    | where eventType has_any (\"user.mfa.factor.activate\", \"user.mfa.factor.update\", \"user.factor.activate\", \"user.mfa.factor.enroll\")\n    | mv-expand Target = target\n    | extend TType = tostring(Target.type), TAlt = tostring(Target.alternateId)\n    // Collapse the mv-expand back to one row per source event so we can pull\n    // BOTH the enrolled phone (UserFactor) and the target user (User) out of\n    // the same target[] array without a row-multiplying join.\n    | summarize\n            PhoneRawArr  = make_set_if(TAlt, TType == \"UserFactor\"),\n            TargetUpnArr = make_set_if(TAlt, TType == \"User\")\n        by TimeGenerated, EventKey = coalesce(uuid, strcat(tostring(TimeGenerated), tostring(actor.alternateId))),\n           eventType, ActorUPN = tolower(tostring(actor.alternateId)), ActorIP = tostring(client.ipAddress)\n    | extend PhoneRawFull = tostring(PhoneRawArr[0])\n    | where isnotempty(PhoneRawFull)\n    // Okta factor alternateId is often prefixed, e.g. \"sms:+15555550123\".\n    | extend PhoneRaw = extract(@'(\\+?\\d[\\d\\-\\s]{5,})', 1, PhoneRawFull)\n    | extend TargetUPN = tolower(tostring(TargetUpnArr[0]))\n    | where isnotempty(PhoneRaw) and isnotempty(TargetUPN)\n    | project TimeGenerated, Provider = \"Okta\", ActorUPN, ActorIP, TargetUPN, PhoneRaw,\n              EventType = eventType, PropName = \"phoneFactor\";\n// =============================== Correlate ==================================\nlet allEvents =\n    union isfuzzy=true entraPhoneEvents, oktaPhoneEvents\n    | evaluate ipv4_lookup(TrustedRanges, ActorIP, VPNRange, false)\n    | extend ActorIsTrustedVPNIP = isnotempty(VPNRange)\n    | extend PhoneNormalized = replace_regex(PhoneRaw, @\"[^\\d+]\", \"\")\n    | where isnotempty(PhoneNormalized) and PhoneNormalized != \"+\"\n    | extend Digits = trim_start(@\"\\+\", PhoneNormalized)\n    | extend IsPremiumRate = array_length(premiumPrefixSet) > 0 and (\n            set_has_element(premiumPrefixSet, substring(Digits, 0, 1))\n         or set_has_element(premiumPrefixSet, substring(Digits, 0, 2))\n         or set_has_element(premiumPrefixSet, substring(Digits, 0, 3))\n         or set_has_element(premiumPrefixSet, substring(Digits, 0, 4)))\n    | extend IsApprovedNumber = set_has_element(approvedSharedNumbers, PhoneNormalized)\n    | project-away VPNRange;\n// Ring signal 1: same phone number registered across multiple providers.\nlet crossProviderPhones =\n    allEvents\n    | summarize DistinctProviders = dcount(Provider), Providers = make_set(Provider, 4) by PhoneNormalized\n    | where DistinctProviders >= 2;\n// Ring signal 2: same phone number registered for many distinct target users.\nlet sharedPhones =\n    allEvents\n    | summarize DistinctUsersForPhone = dcount(TargetUPN), UsersForPhone = make_set(TargetUPN, 32) by PhoneNormalized\n    | where DistinctUsersForPhone >= userRingThreshold;\n// Ring signal 3: same actor registering MFA phones for many distinct targets.\nlet massRegistrationActors =\n    allEvents\n    | where isnotempty(ActorUPN)\n    | summarize DistinctTargetsByActor = dcount(TargetUPN), TargetsByActor = make_set(TargetUPN, 32) by ActorUPN\n    | where DistinctTargetsByActor >= actorRingThreshold;\nallEvents\n| join kind=leftouter (crossProviderPhones) on PhoneNormalized\n| join kind=leftouter (sharedPhones) on PhoneNormalized\n| join kind=leftouter (massRegistrationActors) on ActorUPN\n| extend DistinctProviders      = coalesce(DistinctProviders, 1),\n         DistinctUsersForPhone  = coalesce(DistinctUsersForPhone, 1),\n         DistinctTargetsByActor = coalesce(DistinctTargetsByActor, 1)\n| extend CrossProviderReuse     = DistinctProviders >= 2,\n         PhoneReusedAcrossUsers = DistinctUsersForPhone >= userRingThreshold,\n         ActorMassRegistration  = DistinctTargetsByActor >= actorRingThreshold\n| where not(IsApprovedNumber)\n| where IsPremiumRate or CrossProviderReuse or PhoneReusedAcrossUsers or ActorMassRegistration\n| extend RiskScore = toint(IsPremiumRate) * 2\n                    + toint(CrossProviderReuse) * 2\n                    + toint(PhoneReusedAcrossUsers) * 2\n                    + toint(ActorMassRegistration) * 1\n| extend Signals = set_difference(\n        pack_array(\n            iff(IsPremiumRate,            \"PremiumRateMatch\",       \"\"),\n            iff(CrossProviderReuse,       \"CrossProviderReuse\",     \"\"),\n            iff(PhoneReusedAcrossUsers,   \"PhoneReusedAcrossUsers\", \"\"),\n            iff(ActorMassRegistration,    \"ActorMassRegistration\",  \"\")),\n        dynamic([\"\"]))\n| extend Severity = case(\n        IsPremiumRate and CrossProviderReuse, \"Critical\",\n        RiskScore >= 4,                       \"Critical\",\n        RiskScore >= 2,                       \"High\",\n        \"Medium\")\n| extend AccountName = tostring(split(TargetUPN, \"@\")[0]),\n         UPNSuffix   = tostring(split(TargetUPN, \"@\")[1])\n| project TimeGenerated, Provider, EventType, Severity, RiskScore, Signals,\n          TargetUPN, AccountName, UPNSuffix, ActorUPN, ActorIP, ActorIsTrustedVPNIP,\n          PhoneRaw, PhoneNormalized, IsPremiumRate,\n          DistinctProviders, CrossProviderReuse,\n          DistinctUsersForPhone, PhoneReusedAcrossUsers,\n          DistinctTargetsByActor, ActorMassRegistration\n| extend timestamp = TimeGenerated, AccountCustomEntity = TargetUPN, IPCustomEntity = ActorIP\n| order by Severity asc, RiskScore desc, TimeGenerated desc"
      },
      {
        "name": "6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44 — AWS Security Hub - Detect root user lacking MFA",
        "description": "This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings. Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1556.006.)",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/IAM.9\"\n  or tostring(ComplianceSecurityControlId) == \"IAM.9\"\n| extend RootUserARN = tostring(Resources[0].Id)\n| summarize TimeGenerated = max(TimeGenerated)\n    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,\n       AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN"
      },
      {
        "name": "6f053867-dbd8-4755-924d-577e3db7f5a6 — CYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended Rule",
        "description": "\"This analytics rule identifies network-based indicators such as URLs, IP addresses, and domains related to phishing campaigns, as reported by CYFIRMA threat intelligence. These indicators are flagged with a recommended action to block and are categorized under the 'Phishing' role. Such infrastructure is often used to deliver phishing emails, host fake login portals, or redirect victims to credential-harvesting pages. Blocking these indicators proactively helps prevent user compromise and data theft.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1556.002.)",
        "query": "//Malicious Phishing Network Indicators - Block Recommended\nlet timeFrame= 5m;\nCyfirmaIndicators_CL \n| where ConfidenceScore >= 80\n    and TimeGenerated between (ago(timeFrame) .. now())\n    and pattern !contains 'file:hashes' and RecommendedActions has 'Block' and Roles has 'Phishing'\n| extend IPv4 = extract(@\"ipv4-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend IPv6 = extract(@\"ipv6-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend URL = extract(@\"url:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend Domain = extract(@\"domain-name:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend parsed = parse_json(extensions)\n| extend extensionKeys = bag_keys(parsed)\n| mv-expand extensionKeys\n| extend extensionKeyStr = tostring(extensionKeys)\n| extend ext = parsed[extensionKeyStr]\n| extend props = ext.properties\n| extend \n    extension_id = extensionKeyStr,\n    ASN_Owner = props.asn_owner,\n    ASN = props.asn,\n    ProviderName = 'CYFIRMA',\n    ProductName = 'DeCYFIR/DeTCT'\n| project\n    IPv4,\n    IPv6,\n    URL,\n    Domain,\n    ThreatActors,\n    RecommendedActions,\n    Sources,\n    Roles,\n    Country,\n    IPAbuse,\n    name,\n    Description,\n    ConfidenceScore,\n    IndicatorID,\n    created,\n    modified,\n    valid_from,\n    Tags,\n    ThreatType,\n    TimeGenerated,\n    SecurityVendors,\n    ProductName,\n    ProviderName"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "e4feea34-3b62-4c83-b77f-018fbef48c00 — AWS IAM Virtual MFA Device Registration Attempt with Session Token",
        "description": "(EQL) Detects attempts to create or enable a Virtual MFA device (CreateVirtualMFADevice, EnableMFADevice) using temporary AWS credentials (access keys beginning with ASIA). Session credentials are short-lived and tied to existing authenticated sessions, so using them to register or enable MFA devices is unusual... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "iam where data_stream.dataset == \"aws.cloudtrail\"\n  and event.provider == \"iam.amazonaws.com\"\n  and event.outcome == \"success\"\n  and event.action in (\"CreateVirtualMFADevice\", \"EnableMFADevice\")\n  and startsWith (aws.cloudtrail.user_identity.access_key_id, \"ASIA\")\n  and not aws.cloudtrail.session_credential_from_console == \"true\""
      },
      {
        "name": "5610b192-7f18-11ee-825b-f661ea17fbcd — Stolen Credentials Used to Login to Okta Account After MFA Reset",
        "description": "(EQL) Detects a sequence of suspicious activities on Windows hosts indicative of credential compromise, followed by efforts to undermine multi-factor authentication (MFA) and single sign-on (SSO) mechanisms for an Okta user account. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by user.name with maxspan=12h\n    [any where host.os.type == \"windows\" and signal.rule.threat.tactic.name == \"Credential Access\"]\n    [any where data_stream.dataset == \"okta.system\" and okta.event_type == \"user.mfa.factor.update\"]\n    [any where data_stream.dataset == \"okta.system\" and okta.event_type: (\"user.session.start\", \"user.authentication*\")]"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Modify Authentication Process activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1556 - Modify Authentication Process Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}