Multifactor Authentication Interrupted

Status: test
Severity: medium
Log source: product azure, service signinlogs
Author: AlertIQ
Source: github.com/SigmaHQ/sigma

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts
Credential Access	`T1110` Brute Force `T1621` Multi-Factor Authentication Request Generation

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Sign-in with an incomplete or failed MFA challenge

Rules detecting the same action

These rules filter on the same operation.

Azure AD Authentication Failed During MFA Challenge (Splunk)
Azure AD Multiple Failed MFA Requests For User (Splunk)
Cisco - firewall block but success logon to Microsoft Entra ID (Kusto)
Entra ID MFA TOTP Brute Force Attempted (Elastic)
Failed sign-ins into LastPass due to MFA (Kusto)
MFA Rejected by User (Kusto)

Rule body

title: Multifactor Authentication Interrupted
id: 5496ff55-42ec-4369-81cb-00f417029e25
status: test
description: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
    - attack.t1621
logsource:
    product: azure
    service: signinlogs
detection:
    selection_50074:
        ResultType: 50074
        ResultDescription|contains: 'Strong Auth required'
    selection_500121:
        ResultType: 500121
        ResultDescription|contains: 'Authentication failed during strong authentication request'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_50074`

selection_50074:
    ResultType: 50074
    ResultDescription|contains: 'Strong Auth required'

Stage 2: `selection_500121`

selection_500121:
    ResultType: 500121
    ResultDescription|contains: 'Authentication failed during strong authentication request'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResultDescription`	match	`Authentication failed during strong authentication request` `Strong Auth required`	`field:"azure_ad::result_reason" kind:match`
`ResultType`	eq	`500121` `50074`	`field:"ResultType" kind:eq`