Tag
Unauthorized Modification of Azure Conditional Access Policy
2 rules 2 TTPsAn unauthorized actor modifies an Azure Conditional Access policy, potentially leading to privilege escalation, credential access, persistence, or defense impairment.
Azure AD Root Certificate Authority Added for Passwordless Authentication
2 rules 4 TTPsAn attacker may add a new root certificate authority to an Azure AD tenant to support certificate-based authentication for persistence, privilege escalation, or defense evasion.
Okta Password Entered in AlternateID Field
2 rules 1 TTPOkta logs may contain user passwords if a user mistakenly enters their password into the username field during login, potentially exposing credentials in logs.
Cisco 802.1X (dot1x) Disabled on Network Interface
2 rules 2 TTPsDetection of manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface, potentially allowing unauthorized network access and lateral movement.
User Added to Group with Conditional Access Policy Modification Access
3 rules 4 TTPsAn attacker adds a user to a privileged Azure Active Directory group with permissions to modify Conditional Access policies, potentially leading to privilege escalation, credential access, persistence, and defense impairment.