new: MFA Bypass via registry tampering and PowerShell requirement tam

[damnkrishna]

…pering rules

Summary of the Pull Request

Two new rules covering MFA bypass via Windows Hello PIN / credential provider
registry tampering, and PowerShell-based tampering with a user's Strong
Authentication requirements via the legacy MSOnline/AzureAD modules.
Both map to T1556.006 (Modify Authentication Process: Multi-Factor
Authentication), which had no existing SigmaHQ coverage.

Changelog

new: MFA Bypass Via Windows Hello PIN Or Credential Provider Registry Tampering
new: PowerShell MFA Requirement Tampering On Entra ID Or AD User Object

Example Log Event

Sysmon Event ID 13 (Registry Tampering):

{
  "EventID": 13,
  "Channel": "Microsoft-Windows-Sysmon/Operational",
  "Provider": "Microsoft-Windows-Sysmon",
  "EventData": {
    "RuleName": "-",
    "EventType": "SetValue",
    "UtcTime": "2026-08-08 10:15:30.123",
    "ProcessGuid": "{A1B2C3D4-E5F6-7890-1234-567890ABCDEF}",
    "ProcessId": 4096,
    "Image": "C:\\Windows\\System32\\reg.exe",
    "TargetObject": "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\AllowDomainPINLogon",
    "Details": "DWORD (0x00000000)",
    "User": "NT AUTHORITY\\SYSTEM"
  }
}

PowerShell Script Block Event ID 4104 (MFA Requirement Tampering):

{
  "EventID": 4104,
  "Channel": "Microsoft-Windows-PowerShell/Operational",
  "Provider": "Microsoft-Windows-PowerShell",
  "EventData": {
    "MessageNumber": 1,
    "MessageTotal": 1,
    "ScriptBlockText": "Set-MsolUser -UserPrincipalName 'targetuser@domain.com' -StrongAuthenticationRequirements @()",
    "ScriptBlockId": "f2a1b3c4-d5e6-7890-abcd-ef1234567890",
    "Path": "C:\\Users\\Administrator\\AppData\\Local\\Temp\\tamper.ps1"
  }
}

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @damnkrishna 👋

It looks like this is your first pull request on the Sigma rules repository!

Please read the SigmaHQ conventions to ensure your contribution adheres to best practices and includes all the necessary elements for a successful review.

Also check CONTRIBUTING.md for more information on how to contribute to the Sigma rules repository, specifically proper testing and validation of your rules.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server