AN0290: Analytic 0290
Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.
Analyst context for executives and security teams
This analytic matters because identity provider authentication-flow changes can quickly reduce the effectiveness of enterprise access controls. If an administrator enables reversible password encryption, bypasses MFA, or weakens authentication policy, the organization may lose key protections that executives rely on for cloud, SaaS, and workforce access resilience.
Executive priority
Treat this as an identity-control assurance issue, not only a SOC alert. Leaders should ask whether IdP policy changes are logged, reviewed, and correlated with unusual administrative activity. The business value is evidence that high-risk authentication changes are visible, governed, and defensible for incident response, audit, and access-risk decisions.
Technical view
For the Identity Provider platform, validate that policy modification events for authentication flows are collected and can be correlated with administrative behavior. Detection engineering should focus on suspicious changes such as reversible password encryption, MFA bypass, or authentication policy weakening, then compare those events against the admin account, timing, source context, and expected change process. No ATT&CK tactic or additional relationship context was supplied, so local IdP event schemas and change-management records are required to operationalize this analytic.
Likely telemetry
- Identity provider policy modification events
- Authentication-flow configuration change logs
- Administrative activity logs
- MFA policy change records
- Password policy or encryption setting change records
Detection direction
- Confirm the IdP records authentication-flow and policy modification events with enough detail to identify what changed, who changed it, and when.
- Tune alerts around high-risk changes including MFA bypass, reversible password encryption, and authentication policy weakening.
- Correlate policy changes with unusual administrative activity rather than alerting only on every configuration update.
- Account for expected maintenance windows and approved change tickets to reduce false positives.
- Identify blind spots where IdP configuration changes are not exported to the SIEM or are retained for too short a period.
Mitigation priorities
- Restrict and review administrative privileges for IdP authentication policy management.
- Require formal approval and documentation for high-risk authentication-flow changes.
- Maintain logging and retention for IdP administrative and policy modification events.
- Periodically review MFA, password, and authentication policies for weakening or unauthorized exceptions.
- Test incident response procedures for rapid validation and rollback of unauthorized IdP policy changes.
Analyst notes and limits
The supplied object is a detection analytic, AN0290, for suspicious IdP authentication-flow configuration changes. Its value is strongest when paired with identity governance, change-management evidence, and SOC correlation logic. Because no relationships were supplied, this take does not map the analytic to specific techniques, groups, software, or campaigns.
Official detection content was not provided, tactics were not specified, and no relationship context was supplied. Implementation details depend on the organization’s identity provider, available audit logs, administrative model, and change-control process.
Analytic 0290
Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | fe5a6f0e6c89… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0290Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.