Last reviewed:
T1556.006 covers changing or bypassing multi-factor authentication so an attacker-controlled factor is accepted. In the passkey Silver path, replacing a provider's device user-verification key changes the authentication trust record while later assertions still report successful user verification. DCV cannot observe that provider-side change from a cloud session alone. High-confidence detection joins provider lifecycle evidence to an inventory-backed device, the WebAuthn ceremony and the first federated session; endpoint state reset is supporting evidence when provider telemetry is unavailable.
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor Authentication Request Generation, adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.
For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA.
Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.
Platforms: IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows.
DCV does not currently ship a cloud-audit-log finding mapped directly to T1556.006. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables.
CloudSigma does not currently ship a stand-alone rule that fires on T1556.006 in isolation. Generate a starting-point rule from the CVE, vulnerability disclosure, or threat-research blog post that exercises this technique, then pair it with SIEM-side correlation before enabling in production.
High-fidelity detection of T1556.006 requires correlation
across multiple events. For example, a credential-validation call
followed by a reconnaissance chain (List* /
Describe*) within a short window from an unfamiliar
source. A single-event Sigma rule on
GetCallerIdentity alone fires constantly on
legitimate CLI, SDK and CI/CD activity.
Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1556.006-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1556.006 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.
T1556.006 covers changing or bypassing multi-factor authentication so an attacker-controlled factor is accepted. In the passkey Silver path, replacing a provider's device user-verification key changes the authentication trust record while later assertions still report successful user verification. DCV cannot observe that provider-side change from a cloud session alone. High-confidence detection joins provider lifecycle evidence to an inventory-backed device, the WebAuthn ceremony and the first federated session; endpoint state reset is supporting evidence when provider telemetry is unavailable.
T1556.006 has no cloud-audit-log signal of its own; DCV does not currently ship a finding mapped directly to it. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables (see Related techniques).
T1556.006 is part of MITRE ATT&CK TA0112 Defense Impairment: How adversaries disable or degrade the defences that would have spotted them.
T1556.006 requires multi-event correlation that exceeds a single Sigma rule's structure. CloudSigma can generate a starting-point rule from a CVE, vulnerability disclosure, or threat-research blog post that exercises T1556.006-style abuse; pair it with SIEM-side correlation logic before enabling in production.