new: MFA Bypass via registry tampering and PowerShell requirement tampering rules

Author: damnkrishna

rules/windows/powershell/powershell_script/posh_ps_mfa_requirement_tampering.yml

@@ -0,0 +1,33 @@
+title: PowerShell MFA Requirement Tampering On Entra ID Or AD User Object
+id: c10c6c11-0f72-4025-82ea-6e121ba1ffed
+status: experimental
+description: |
+    Detects PowerShell script blocks that clear or weaken a user's Strong Authentication (MFA) requirements
+    via the legacy MSOnline or AzureAD modules, which can be used to bypass MFA enforcement for a targeted account.
+references:
+    - https://learn.microsoft.com/en-us/powershell/module/msonline/set-msoluser
+author: Krishna Gupta
+date: 2026-08-08
+tags:
+    - attack.defense-evasion
+    - attack.t1556.006
+logsource:
+    product: windows
+    category: ps_script
+    definition: 'Requirements: Script Block Logging must be enabled'
+detection:
+    selection_cmdlet:
+        ScriptBlockText|contains:
+            - 'Set-MsolUser'
+            - 'Set-AzureADUser'
+    selection_param:
+        ScriptBlockText|contains: 'StrongAuthenticationRequirements'
+    selection_clear:
+        ScriptBlockText|contains:
+            - '= $null'
+            - '= @()'
+            - '.Clear()'
+    condition: all of selection_*
+falsepositives:
+    - Legitimate administration scripts resetting a user's MFA methods at their request
+level: high

rules/windows/registry/registry_set/registry_set_mfa_credential_provider_tampering.yml

@@ -0,0 +1,29 @@
+title: MFA Bypass Via Windows Hello PIN Or Credential Provider Registry Tampering
+id: f514d72b-9c1c-4109-bc9f-1674486af72f
+status: experimental
+description: |
+    Detects registry modifications that disable domain PIN sign-in (AllowDomainPINLogon) or disable a Credential Provider,
+    both of which can be used to weaken or bypass multi-factor authentication enforcement on a Windows host.
+references:
+    - https://gpedit.tplant.com.au/en-us/policy/CredentialProviders/AllowDomainPINLogon/
+    - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-credentialproviders
+author: Krishna Gupta
+date: 2026-08-08
+tags:
+    - attack.defense-evasion
+    - attack.t1556.006
+logsource:
+    category: registry_set
+    product: windows
+detection:
+    selection_pin_disable:
+        TargetObject|endswith: '\Policies\Microsoft\Windows\System\AllowDomainPINLogon'
+        Details: 'DWORD (0x00000000)'
+    selection_cred_provider_disable:
+        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\'
+        TargetObject|endswith: '\Disabled'
+        Details: 'DWORD (0x00000001)'
+    condition: 1 of selection_*
+falsepositives:
+    - Administrators deliberately disabling convenience PIN sign-in or a specific credential provider as part of a hardening baseline
+level: medium