Multi-Factor Authentication Request Generation T1621

Tactic: Credential Access

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Authoring guide

Patterns shared across the 31 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (66 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
sourcetype13eq 13OktaIM2:log, aws:cloudtrail, azure:monitor:aad, gws:reports:login, aws:asl
aws::eventName4eq 4ConsoleLogin, DeactivateMFADevice, DeleteVirtualMFADevice
eventtype4eq 4
mfa_prompts4ge 2, gt 210, 9
"result.message"3contains 1, in 1, starts_with 1device paired, *Action: Allowed*, *Action: Approve*, *Action: Authenticate*
EventID3eq 2, in 1user.authentication.auth_via_mfa, 4723, 4724, system.push.send_factor_verify_push
category3eq 3SignInLogs
count3gt 2, ge 110, 9
data_stream.dataset3eq 3okta.system, azure.auditlogs
eventType3eq 3user.authentication.auth_via_mfa, system.push.send_factor_verify_push, user.authentication.verify
okta::eventType3eq 3, in 1user.authentication.auth_via_mfa, user.mfa.okta_verify.deny_push, system.push.send_factor_verify_push, user.authentication.sso, user.authentication.verify
"result.status"2in 2, eq 1FAIL*, FAILURE,authFail, POLICY, SUCCESS*, UNSUCCESSFUL_ATTEMPT
additionalEventData.MFAUsed2eq 2Yes
aws::errorMessage2eq 2Failed authentication
data.type2eq 2gd_send_pn

Top indicator values (114 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
categoryeq
SignInLogs
312
eventTypeeq
user.authentication.auth_via_mfa
36
okta::eventTypeeq
user.authentication.auth_via_mfa
35
okta::eventTypeeq
user.mfa.okta_verify.deny_push
33
sourcetypeeq
OktaIM2:log
312
sourcetypeeq
aws:cloudtrail
359
sourcetypeeq
azure:monitor:aad
347
EventIDeq
user.authentication.auth_via_mfa
25
additionalEventData.MFAUsedeq
Yes
23
aws::errorMessageeq
Failed authentication
24
aws::eventNameeq
ConsoleLogin
227
aws::eventNameeq
DeactivateMFADevice
22
aws::eventNameeq
DeleteVirtualMFADevice
22
data.typeeq
gd_send_pn
22
data_stream.dataseteq
okta.system
248
event.nameeq
login_failure
24
event.parameters{}.multiValue{}in
backup_code
22
event.parameters{}.multiValue{}in
google_authenticator
22
event.parameters{}.multiValue{}in
google_prompt
22
event.parameters{}.multiValue{}in
idv_any_phone
22
event.parameters{}.multiValue{}in
idv_preregistered_phone
22
event.parameters{}.multiValue{}in
internal_two_factor
22
event.parameters{}.multiValue{}in
knowledge_employee_id
22
event.parameters{}.multiValue{}in
knowledge_preregistered_email
22
event.parameters{}.multiValue{}in
knowledge_preregistered_phone
22
event.parameters{}.multiValue{}in
login_location
22
event.parameters{}.multiValue{}in
offline_otp
22
event.parameters{}.multiValue{}in
security_key
22
event.parameters{}.multiValue{}in
security_key_otp
22
mfa_promptsge
10
22

Exclusions (6 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
"result.message"in
*create*
1
"result.message"in
*delete*
1
"result.message"in
*pair*
1
auth_msgeq
MFA successfully completed
1
aws::eventNamene
ConsoleLogin
1
aws::eventSourcene
signin.amazonaws.com
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 3 rules

Splunk 18 rules

Kusto 1 rule

YARA-L 2 rules

Panther 4 rules