Multi-Factor Authentication Interception T1111

Tactic: Credential Access

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

Authoring guide

Patterns shared across the 4 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (9 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventMessage1eq 1TURN_OFF_2_STEP_VERIFICATION
EventStartTime1lt 1TimeGenerated
EventType1eq 1user.mfa.attempt_bypass
ResultType1eq 10
RiskLevelAggregated1eq 1high
RiskLevelDuringSignIn1eq 1high
TimeDelta1le 110m
data_stream.dataset1eq 1okta.system
event.kind1eq 1alert

Top indicator values (9 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventMessageeq
TURN_OFF_2_STEP_VERIFICATION
1
EventStartTimelt
TimeGenerated
1
EventTypeeq
user.mfa.attempt_bypass
1
ResultTypeeq
0
119
RiskLevelAggregatedeq
high
12
RiskLevelDuringSignIneq
high
12
TimeDeltale
10m
1
data_stream.dataseteq
okta.system
148
event.kindeq
alert
136

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 1 rule

Kusto 2 rules

Panther 1 rule