tfMITRE ATT&CK sub-technique

Multi-Factor Authentication T1556.006

sub-technique of T1556 Modify Authentication Process

Tactics: Persistence, Defense Impairment, Credential Access
Platforms: IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.0
Created: 31 May 2022
Last modified: 12 May 2026
Contributors: Arun Seelagan, CISA; Liran Ravich, CardinalOps; Muhammad Moiz Arshad, @5T34L7H

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 18%

Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.

Multi-Factor Authentication MITRE reference T1556.006

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Scattered SpiderG1015 ↗

After compromising user accounts, Scattered Spider registers their own MFA tokens.1

created 2023-07-051 referenceaka Roasted 0ktapus

All 1 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries modified two-factor settings within the FortiGate solution to unset.1

2025

All 1 campaigns for this technique

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SLOWPULSES1104 ↗

Can insert malicious logic to bypass RADIUS and ACE two factor authentication (2FA) flows if a designated attacker-supplied password is provided.1

created 2024-02-06MALWAREcarried by 1 group

AADInternalsS0677 ↗

The AADInternals Set-AADIntUserMFA command can be used to disable MFA for a specified user.

created 2022-02-01TOOLcarried by 2 groups

All 2 software entries for this technique

Offense vs defense T1556.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 11

first rule: 2021 Q3 · 1 of 1 campaigns plotted

Multi-Factor Authentication detection strategy DET0190

MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect MFA Modification or Disabling Across Platforms

Enterprise

7 platforms

AN0543 · Windows

Detects registry and Group Policy modifications that disable or weaken MFA, suspicious PowerShell usage modifying MFA-related attributes, and anomalous login sessions succeeding without expected MFA challenge.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	WinEventLog:PowerShell	Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled
Active Directory Object ModificationDC0066	WinEventLog:Security	EventCode=4739

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedAttributes	List of AD attributes or policy fields tied to MFA enforcement that may vary by organization.
TimeWindow	Correlation window between MFA policy changes and anomalous login behavior.

AN0544 · Identity Provider

Detects conditional access policy changes, exclusion of accounts from MFA enforcement, or registration of new MFA factors by non-admin or anomalous users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	m365:unified	User excluded from MFA or MFA method registered
Application Log ContentDC0038	azure:signinlogs	Modify Conditional Access Policy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegedRoles	Roles permitted to modify MFA settings in IdP; helps tune detection of unauthorized changes.

AN0545 · IaaS

Detects API calls to cloud secrets/MFA configurations where MFA enforcement policies are disabled or bypassed.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service ModificationDC0069	AWS:CloudTrail	UpdateIdentityPolicy or DisableMFA

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredServices	Specific cloud services or IAM policies relevant to MFA enforcement.

AN0546 · Linux

Detects PAM module modifications or removal of MFA hooks in /etc/pam.d/ configurations, correlated with successful authentications lacking MFA prompts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	NSM:Connections	Successful login without expected MFA challenge
File ModificationDC0061	auditd:SYSCALL	open/write to /etc/pam.d/*

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MFAHooks	Paths to organization-specific PAM modules enforcing MFA.

AN0547 · macOS

Detects modifications to authorization plugins responsible for MFA enforcement and correlates with suspicious login sessions missing MFA prompts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	macos:unifiedlog	Login success without MFA step
File ModificationDC0061	macos:unifiedlog	Modification of /Library/Security/SecurityAgentPlugins

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WatchedPluginPaths	Paths to organization-deployed MFA authorization plugins.

AN0548 · SaaS

Detects suspicious MFA method changes, such as registration of weaker factors (e.g., SMS), or removal of MFA requirements for specific accounts or groups.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	saas:zoom	DisableMFA or RegisterNewFactor

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AcceptedFactors	Configured MFA factors allowed in SaaS environment; tuned to organizational policies.

AN0549 · Office Suite

Detects MFA bypass attempts by modifying tenant-wide authentication policies or excluding high-value accounts from MFA enforcement.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	Set-CsOnlineUser or UpdateAuthPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPolicies	Specific tenant or suite policies tied to MFA enforcement.

Multi-Factor Authentication detections T1556.006

14 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 18%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs