Multi-Factor Authentication Interception T1111
Tactic: Credential Access
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
Authoring guide
These 4 rules share fields, values, and exclusions.
Fields filtered most (7 distinct)
These fields appear most often in rule filters.
Top indicator values (7 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Elastic 1 rule
Kusto 2 rules
- GWorkspace - Two-step authentification disabled for a user
- Possible AiTM Phishing Attempt Against Microsoft Entra ID