ATT&CK technique
View on MITRE ATT&CK →
T1556.009
Conditional Access Policies
Defense ImpairmentPersistenceCredential Access
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Entra ID Conditional Access Policy (CAP) Modified | production | 2026-10-06 |
| elastic | AWS RDS DB Instance Made Public | production | 2026-09-18 |
| elastic | Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN | production | 2026-09-18 |
| elastic | Entra ID External Authentication Methods (EAM) Modified | production | 2026-09-18 |
| elastic | Modification or Removal of an Okta Application Sign-On Policy | production | 2026-09-18 |