MFA was disabled for a Google Workspace user

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Google Workspace Audit Logs
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Google Workspace
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Severity	Informational

Description

Multi-Factor Authentication (MFA) has been disabled for a Google Workspace user.

Attacker's Goals

Adversaries may impair defenses by disabling Multi-Factor Authentication (MFA) to maintain persistence and evade detection.

Investigative actions

• Verify if the MFA disablement was authorized.
• Investigate the source IP and User Agent for previous malicious activity or anomalies.
• Follow further actions done by the user and IP address.

Variations

MFA was disabled for a Google Workspace administrative user

Synopsis

Field	Value
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Severity	Medium

Description

Multi-Factor Authentication (MFA) has been disabled for a Google Workspace user.

Attacker's Goals

Adversaries may impair defenses by disabling Multi-Factor Authentication (MFA) to maintain persistence and evade detection.

Investigative actions

• Verify if the MFA disablement was authorized.
• Investigate the source IP and User Agent for previous malicious activity or anomalies.
• Follow further actions done by the user and IP address.

MFA was disabled for a Google Workspace user by a different account for the first time

Synopsis

Field	Value
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Severity	Low

Description

Multi-Factor Authentication (MFA) has been disabled for a Google Workspace user.

Attacker's Goals

Adversaries may impair defenses by disabling Multi-Factor Authentication (MFA) to maintain persistence and evade detection.

Investigative actions

• Verify if the MFA disablement was authorized.
• Investigate the source IP and User Agent for previous malicious activity or anomalies.
• Follow further actions done by the user and IP address.