O365 - Expand Detection of New MFA Devices

detections/cloud/o365_new_mfa_method_registered.yml

@@ -1,7 +1,7 @@
 name: O365 New MFA Method Registered
 id: 4e12db1f-f7c7-486d-8152-a221cad6ac2b
-version: 7
-date: '2025-05-02'
+version: 8
+date: '2026-01-16'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -14,24 +14,31 @@ description: The following analytic detects the registration of a new Multi-Fact
   account. If confirmed malicious, the attacker could bypass existing security measures,
   solidify their access, and potentially escalate privileges or access sensitive data.
   Immediate verification and remediation are required to secure the affected account.
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update user.\" 
-  | eval propertyName = mvindex('ModifiedProperties{}.Name', 0) 
-  | search propertyName = StrongAuthenticationMethod 
-  | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0) 
-  | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) 
-  | rex field=newvalue max_match=0 \"(?i)(?<new_method_type>\\\"MethodType\\\")\" 
-  | rex field=oldvalue max_match=0 \"(?i)(?<old_method_type>\\\"MethodType\\\")\" 
-  | eval count_new_method_type = coalesce(mvcount(new_method_type), 0) 
-  | eval count_old_method_type = coalesce(mvcount(old_method_type), 0) 
-  | where count_new_method_type > count_old_method_type 
-  | fillnull 
-  | stats earliest(_time) as firstTime latest(_time) as lastTime values(propertyName) by user newvalue oldvalue vendor_account vendor_product dest signature src 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `o365_new_mfa_method_registered_filter`"
+search: |
+  `o365_management_activity`
+  Workload=AzureActiveDirectory
+  Operation="Update user."
+  | eval propertyName = mvindex('ModifiedProperties{}.Name', 0)
+  | search propertyName IN ("StrongAuthenticationMethod", "StrongAuthenticationPhoneAppDetail")
+  | eval oldvalue = mvindex('ModifiedProperties{}.OldValue',0)
+  | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0)
+  | rex field=newvalue max_match=0 "(?i)(?<new_method_type>MethodType|DeviceName)"
+  | rex field=oldvalue max_match=0 "(?i)(?<old_method_type>MethodType|DeviceName)"
+  | eval count_new_method_type = coalesce(mvcount(new_method_type), 0)
+  | eval count_old_method_type = coalesce(mvcount(old_method_type), 0)
+  | where count_new_method_type > count_old_method_type
+  | fillnull
+  | stats earliest(_time) as firstTime
+          latest(_time) as lastTime
+          values(propertyName) as propertyName
+    by user newvalue oldvalue vendor_account
+       vendor_product dest signature src
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `o365_new_mfa_method_registered_filter`
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest
   Office 365 management activity events.
-known_false_positives: Users may register MFA methods legitimally, investigate and
+known_false_positives: Users may register MFA methods legitimately, investigate and
   filter as needed.
 references:
 - https://attack.mitre.org/techniques/T1098/005/
@@ -72,7 +79,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
+  - data:
       https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method.log
     sourcetype: o365:management:activity
     source: o365