AN0548: Analytic 0548
Detects suspicious MFA method changes, such as registration of weaker factors (e.g., SMS), or removal of MFA requirements for specific accounts or groups.
Analyst context for executives and security teams
This analytic matters because changes to MFA settings can directly affect whether SaaS accounts remain protected against account takeover. For leaders, the key issue is not simply whether MFA is enabled, but whether the organization can see when stronger controls are weakened, removed, or changed for important users and groups.
Executive priority
Prioritize this as an identity and SaaS control-validation issue. Security leaders should ask whether MFA changes are logged, reviewed, and explainable for privileged accounts, high-risk users, and key business groups. This evidence is also useful for incident response scoping and compliance readiness because it helps show whether authentication safeguards were maintained or altered.
Technical view
SOC and identity teams should validate monitoring for SaaS audit events that show MFA method registration, removal, downgrade to weaker factors such as SMS, or removal of MFA requirements for specific accounts or groups. Because the ATT&CK object provides no specific detection logic, teams should map this analytic to their SaaS identity provider logs, administrative audit trails, group policy changes, and change-management records.
Likely telemetry
- SaaS identity provider audit logs
- MFA method registration and removal events
- Conditional access or MFA policy change logs
- User and group membership change logs
- Administrator activity logs
Detection direction
- Alert on MFA requirement removal or MFA policy weakening for users, groups, and privileged roles.
- Review new registration of weaker MFA factors, such as SMS, especially for high-value or administrative accounts.
- Correlate MFA changes with administrator actions, help desk workflows, recent account recovery activity, and approved change tickets to reduce false positives.
- Validate whether SaaS logs retain enough detail to identify who made the change, which account or group was affected, and what factor or requirement changed.
- Treat lack of centralized SaaS audit collection as a coverage gap for this analytic.
Mitigation priorities
- Require formal approval and logging for MFA policy changes affecting accounts or groups.
- Prefer stronger MFA methods where supported and restrict weaker factors when business requirements allow.
- Limit who can modify MFA requirements and review those permissions regularly.
- Include MFA setting changes in incident response playbooks for suspected account compromise.
- Periodically audit SaaS MFA configurations against identity policy and compliance requirements.
Analyst notes and limits
This is a detection analytic for SaaS environments focused on suspicious MFA method changes. The most important local validation is whether the organization can distinguish approved administrative changes from risky weakening or removal of authentication controls.
The supplied ATT&CK fields do not include detection logic, tactics, relationships, procedures, or vendor-specific data sources. Conclusions should be validated against the organization’s actual SaaS platforms, identity architecture, log retention, and MFA policy model.
Analytic 0548
Detects suspicious MFA method changes, such as registration of weaker factors (e.g., SMS), or removal of MFA requirements for specific accounts or groups.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | b0bd48f3c049… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0548Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.