Techniques › T1556 › T1556.009

T1556.009 Conditional Access Policies

defense impairment · persistence · credential access — IaaS, Identity Provider · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0030 Detect Conditional Access Policy Modification in Identity and Cloud Platforms v1.0
  AN0087 IaaS

  Detects modifications to IAM conditions or policies that alter authentication behavior, such as adding permissive trusted IPs, removing MFA requirements, or changing regional access restrictions. Behavioral detection focuses on anomalous policy updates tied to privileged accounts and subsequent suspicious logon activity from previously blocked regions or devices.

  AWS:CloudTrail PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion → DC0069 Cloud Service Modification

  Tunable: MonitoredIAMConditions TimeWindow PrivilegedAccounts
  AN0088 Identity Provider

  Detects suspicious updates to conditional access or MFA enforcement policies in identity providers such as Entra ID, Okta, or JumpCloud. Focus is on removal of policy blocks, addition of broad exclusions, or registration of adversary-controlled MFA methods, followed by anomalous login activity that takes advantage of the modified policies.

  azure:activity Update conditionalAccessPolicy → DC0066 Active Directory Object Modification

  saas:okta Conditional Access policy rule modified or MFA requirement disabled → DC0038 Application Log Content

  Tunable: TargetedApplications RiskThresholds UserContext

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556.009

Rules tagged at the parent level (attack.t1556) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.