MFA Disabled for Google Workspace

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Google Workspace Audit Logs
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Google Workspace
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556), Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Severity	Low

Description

An administrator has disabled Multi-Factor Authentication for Google Workspace users.

Attacker's Goals

Gain access to Google Workspace accounts with disabled MFA. Exploit Google Workspace accounts with weaker security. Steal sensitive data from Google Workspace accounts.

Investigative actions

• Check the MFA settings for the Google Workspace users.
• Identify the users who have MFA disabled and investigate the reason for it.
• Check the security log to see if there have been any suspicious activities in the account.

Variations

MFA Disabled for Google Workspace from an unusual caller IP ASN

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556), Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Severity	Low

Description

An administrator has disabled Multi-Factor Authentication for Google Workspace users.

Attacker's Goals

Gain access to Google Workspace accounts with disabled MFA. Exploit Google Workspace accounts with weaker security. Steal sensitive data from Google Workspace accounts.

Investigative actions

• Check the MFA settings for the Google Workspace users.
• Identify the users who have MFA disabled and investigate the reason for it.
• Check the security log to see if there have been any suspicious activities in the account.