Storm-0501G1053 ↗
Has registered their own MFA method, and leveraged a victim hybrid joined server to circumvent Conditional Access Policies.1
tfMITRE ATT&CK sub-technique
Conditional Access Policies T1556.009
sub-technique of T1556 Modify Authentication Process
- Platforms
- IaaS, Identity Provider
- Version
- 2.0
- Created
- 02 January 2024
- Last modified
- 12 May 2026
- Contributors
- Gavin Knapp; Joshua Penny
Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Conditional Access Policies MITRE reference T1556.009
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scattered SpiderG1015 ↗
Has added additional trusted locations to Azure AD conditional access policies. 1
All 2 groups for this technique
Offense vs defense T1556.009
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Conditional Access Policies detection strategy DET0030
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Conditional Access Policy Modification in Identity and Cloud Platforms
2 platforms
AN0087 · IaaS
Detects modifications to IAM conditions or policies that alter authentication behavior, such as adding permissive trusted IPs, removing MFA requirements, or changing regional access restrictions. Behavioral detection focuses on anomalous policy updates tied to privileged accounts and subsequent suspicious logon activity from previously blocked regions or devices.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Service ModificationDC0069 | AWS:CloudTrail | PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredIAMConditions | Specific condition keys (SourceIp, RequestedRegion, MFAAuthenticated) tuned per environment. |
| TimeWindow | Correlates policy modification with follow-on logins from newly permitted sources. |
| PrivilegedAccounts | List of administrative accounts to prioritize when monitoring for conditional access changes. |
AN0088 · Identity Provider
Detects suspicious updates to conditional access or MFA enforcement policies in identity providers such as Entra ID, Okta, or JumpCloud. Focus is on removal of policy blocks, addition of broad exclusions, or registration of adversary-controlled MFA methods, followed by anomalous login activity that takes advantage of the modified policies.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:okta | Conditional Access policy rule modified or MFA requirement disabled |
| Active Directory Object ModificationDC0066 | azure:activity | Update conditionalAccessPolicy |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetedApplications | Specific SaaS or cloud apps most sensitive to conditional access changes. |
| RiskThresholds | Risk scores or signals that may be tuned for anomaly detection in login behavior. |
| UserContext | Business roles or expected MFA patterns per user/group to reduce false positives. |
Limit permissions to modify conditional access policies to only those required.