Analytics BIOC
Low
✕
MFA Disabled for Google Workspace
An administrator has disabled Multi-Factor Authentication for Google Workspace users.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Modify Authentication Process (T1556) Modify Authentication Process: Multi-Factor Authentication (T1556.006)
Detector tags: Google Workspace
Attacker's goals:
Gain access to Google Workspace accounts with disabled MFA. Exploit Google Workspace accounts with weaker security. Steal sensitive data from Google Workspace accounts.
Investigative actions:
Check the MFA settings for the Google Workspace users. Identify the users who have MFA disabled and investigate the reason for it. Check the security log to see if there have been any suspicious activities in the account.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- MFA Disabled for Google Workspace from an unusual caller IP ASN Low