From 0e7356bccb01f83530fc4a5298b1f44978ffd466 Mon Sep 17 00:00:00 2001 From: PhyoPaingHtun ChiLai <83696447+PhyoPaingHtun@users.noreply.github.com> Date: Tue, 5 Dec 2023 01:30:59 +0700 Subject: [PATCH] Update T1112.yaml (Update Disable FIDO Authentication) (#2626) Co-authored-by: Carrie Roberts --- atomics/T1112/T1112.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/atomics/T1112/T1112.yaml b/atomics/T1112/T1112.yaml index 40ca80b4..8a87b367 100644 --- a/atomics/T1112/T1112.yaml +++ b/atomics/T1112/T1112.yaml @@ -946,3 +946,15 @@ atomic_tests: cleanup_command: | reg add "HKLM\SOFTWARE\Policies\Microsoft\SecondaryAuthenticationFactor" /v "AllowSecondaryAuthenticationDevice" /t REG_DWORD /d 1 /f name: command_prompt +- name: Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value. + description: | + Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks. + See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon). + supported_platforms: + - windows + executor: + command: | + reg add "HKLM\SOFTWARE\Policies\Microsoft\FIDO" /v "AllowExternalDeviceSignon" /t REG_DWORD /d 0 /f + cleanup_command: | + reg add "HKLM\SOFTWARE\Policies\Microsoft\FIDO" /v "AllowExternalDeviceSignon" /t REG_DWORD /d 1 /f + name: command_prompt