Asana user multi-factor authentication method disabled

This rule is part of a beta feature. To learn more, contact Support.
asana

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1556-modify-authentication-process

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when a user has disabled two-factor authentication (2FA) for their account. This could indicate an attacker who is maintaining access to a compromised user account by weakening the account’s security controls.

Strategy

This rule monitors multi-factor authentication removal events across users and raises an alert if a user disables their registered method.

Triage and response

  1. Review logs to identify the user {{@usr.email}} who has disabled multi-factor authentication.
  2. Determine if the action was user-initiated or performed by an administrator by checking if the log indicates a specific initiator {{@resource.email}}.
  3. Investigate any recent login and action-related event logs within the Asana platform by {{@usr.email}} that could demonstrate anomalous behavior.
  4. If the change appears malicious, invoke your security incident response process. Next steps could include:
    • Temporarily suspend the affected account.
    • Rotate user credentials.
    • Work with the user to re-enroll in multi-factor authentication.