↳ Source GitHubRègle analytiqueMedium

GitHub Two Factor Auth Disable

Description

'Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected. '

Type de règle: Scheduled
Version: 1.0.2
Statut déclaré: Available
Fréquence: 1d
Période analysée: 1d
Déclenchement: gt 0

Couverture MITRE déclarée

DefenseEvasion T1562

Requête KQL

Requête originale, sans modification.

GitHubAuditData
| where Action == "org.disable_two_factor_requirement"
| project TimeGenerated, Action, Actor, Country, Repository
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

Entités déclarées

Account

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Fichier: Solutions/GitHub/Analytic Rules/GitHub - Two Factor Authentication Disabled in GitHub.yaml ↗
Commit: 9800e51 ↗
Identifiant source: 3ff0fffb-d963-40c0-b235-3404f915add7

Autres fichiers source 2

Solutions/GitHub/Analytic Rules/GitHub - Two Factor Authentication Disabled in GitHub.yamlsource ↗Solutions/GitHub/data/Solution_GitHub.jsonsolution-membership ↗

GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.