↳ GitHub sourceAnalytics ruleMedium

NRT GitHub Two Factor Auth Disable

Description

'Two-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. Two factor authentication reduces the risk of account takeover. Attacker will want to disable such security tools in order to go undetected. '

Rule type: NRT
Version: 1.0.3

Declared MITRE coverage

DefenseEvasion T1562

KQL query

Original query, unchanged.

GitHubAuditData
| where Action == "org.disable_two_factor_requirement"
| project TimeGenerated, Action, Actor, Country, Repository
| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

Declared entities

Account

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/GitHub/Analytic Rules/NRT Two Factor Authentication Disabled.yaml ↗
Commit: 9800e51 ↗
Source identifier: 594c653d-719a-4c23-b028-36e3413e632e

Additional source files 3

Solutions/GitHub/Analytic Rules/NRT Two Factor Authentication Disabled.yamlsource ↗Detections/GitHub/NRT Two Factor Authentication Disabled.yamlmigration-note ↗Solutions/GitHub/data/Solution_GitHub.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.