{"id":"5496ff55-42ec-4369-81cb-00f417029e25","title":"Multifactor Authentication Interrupted","description":"Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.","author":"AlertIQ","status":"test","level":"medium","date":"2021-10-10","modified":"2022-12-18","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1078.004","attack.t1110","attack.t1621"],"technique_ids":["T1078.004","T1110","T1621"],"logsource":{"product":"azure","service":"signinlogs"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts"],"source_path":"rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml","source_sha256":"99d485c6f264989165b939b54e1b67e92f23d3951eab433e901cf34d3b4e8b91","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Multifactor Authentication Interrupted\nid: 5496ff55-42ec-4369-81cb-00f417029e25\nstatus: test\ndescription: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.\nreferences:\n    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts\nauthor: AlertIQ\ndate: 2021-10-10\nmodified: 2022-12-18\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.credential-access\n    - attack.stealth\n    - attack.t1078.004\n    - attack.t1110\n    - attack.t1621\nlogsource:\n    product: azure\n    service: signinlogs\ndetection:\n    selection_50074:\n        ResultType: 50074\n        ResultDescription|contains: 'Strong Auth required'\n    selection_500121:\n        ResultType: 500121\n        ResultDescription|contains: 'Authentication failed during strong authentication request'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078.004","id":"T1078.004","name":"Cloud Accounts","page":"techniques/enterprise/T1078.004/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1621","id":"T1621","name":"Multi-Factor Authentication Request Generation","page":"techniques/enterprise/T1621/"}],"data_path":"data/detection-rules/5496ff55-42ec-4369-81cb-00f417029e25.json","kind":"sigma"}