{"id":"T1556.009","name":"Conditional Access Policies","url":"https://attack.mitre.org/techniques/T1556/009","tactics":["defense-impairment","persistence","credential-access"],"platforms":["IaaS","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0030","stix_id":"x-mitre-detection-strategy--4cd84c0e-b125-4576-9441-57c1664bf014","name":"Detect Conditional Access Policy Modification in Identity and Cloud Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0030","analytics":[{"id":"AN0087","stix_id":"x-mitre-analytic--b88f87d2-4a64-44a2-937e-85a929203843","name":"Analytic 0087","description":"Detects modifications to IAM conditions or policies that alter authentication behavior, such as adding permissive trusted IPs, removing MFA requirements, or changing regional access restrictions. Behavioral detection focuses on anomalous policy updates tied to privileged accounts and subsequent suspicious logon activity from previously blocked regions or devices.","url":"https://attack.mitre.org/detectionstrategies/DET0030#AN0087","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"MonitoredIAMConditions","description":"Specific condition keys (SourceIp, RequestedRegion, MFAAuthenticated) tuned per environment."},{"field":"TimeWindow","description":"Correlates policy modification with follow-on logins from newly permitted sources."},{"field":"PrivilegedAccounts","description":"List of administrative accounts to prioritize when monitoring for conditional access changes."}],"live":true,"detection_strategies":["DET0030"],"techniques":["T1556.009"]},{"id":"AN0088","stix_id":"x-mitre-analytic--9eb2a081-e252-4009-a16e-90c9a85f70f1","name":"Analytic 0088","description":"Detects suspicious updates to conditional access or MFA enforcement policies in identity providers such as Entra ID, Okta, or JumpCloud. Focus is on removal of policy blocks, addition of broad exclusions, or registration of adversary-controlled MFA methods, followed by anomalous login activity that takes advantage of the modified policies.","url":"https://attack.mitre.org/detectionstrategies/DET0030#AN0088","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:activity","channel":"Update conditionalAccessPolicy","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"azure-activity"},{"name":"saas:okta","channel":"Conditional Access policy rule modified or MFA requirement disabled","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-okta"}],"mutable_elements":[{"field":"TargetedApplications","description":"Specific SaaS or cloud apps most sensitive to conditional access changes."},{"field":"RiskThresholds","description":"Risk scores or signals that may be tuned for anomaly detection in login behavior."},{"field":"UserContext","description":"Business roles or expected MFA patterns per user/group to reduce false positives."}],"live":true,"detection_strategies":["DET0030"],"techniques":["T1556.009"]}],"live":true,"version":"1.0","techniques":["T1556.009"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}