{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1621","id":"T1621","name":"Multi-Factor Authentication Request Generation","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1621","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"373b8dc6492fa29abeab64dc906bf5ab8d3b0da918b3fc3e493e2169d760402d","description":"Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.\n\nAdversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023)\n\nIn some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1621","external_id":"T1621"},{"source_name":"Russian 2FA Push Annoyance - Cimpanu","description":"Catalin Cimpanu. (2021, December 9). Russian hackers bypass 2FA by annoying victims with repeated push notifications. Retrieved March 31, 2022.","url":"https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/"},{"source_name":"MFA Fatigue Attacks - PortSwigger","description":"Jessica Haworth. (2022, February 16). MFA fatigue attacks: Users tricked into allowing device access due to overload of push notifications. Retrieved March 31, 2022.","url":"https://portswigger.net/daily-swig/mfa-fatigue-attacks-users-tricked-into-allowing-device-access-due-to-overload-of-push-notifications"},{"source_name":"Suspected Russian Activity Targeting Government and Business Entities Around the Globe","description":"Luke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock. (2021, December 6). Suspected Russian Activity Targeting Government and Business Entities Around the Globe. Retrieved April 15, 2022.","url":"https://www.mandiant.com/resources/russian-targeting-gov-business"},{"source_name":"Obsidian SSPR Abuse 2023","description":"Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.","url":"https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/"}],"platforms":["Windows","Linux","macOS","IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1621","id":"T1621","name":"Multi-Factor Authentication Request Generation","domain":"enterprise","platforms":["Windows","Linux","macOS","IaaS","SaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1621","technique_page":"techniques/enterprise/T1621/","page":"detections/enterprise/T1621/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"e40f4962-b02b-4192-9bfe-245f7ece1f99","title":"Multifactor Authentication Denied","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/e40f4962-b02b-4192-9bfe-245f7ece1f99.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_mfa_denies.yml","author":"AlertIQ","kind":"sigma"},{"id":"5496ff55-42ec-4369-81cb-00f417029e25","title":"Multifactor Authentication Interrupted","status":"test","level":"medium","logsource":{"product":"azure","service":"signinlogs"},"data_path":"data/detection-rules/5496ff55-42ec-4369-81cb-00f417029e25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml","author":"AlertIQ","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1621-1","technique_id":"T1621","title":"T1621 Multi-Factor Authentication Request Generation","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#credential-access","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":116,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L116","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"5a576dc51a529b7465121fa6fe401a54a4e0a4fcd7f497ee1a3bf2700b2d1d20","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(mfa_challenge BY account, 10m) >= threshold OR COUNT(mfa_denied BY account, 10m) >= threshold -> ALERT","log_sources":[{"title":"Multi-Factor Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#44-multi-factor-authentication-logs"},{"title":"Identity Provider Sign-In Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#39-identity-provider-sign-in-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1621-1","technique_id":"T1621","title":"Repeated MFA prompts and denials — T1621 Multi-Factor Authentication Request Generation","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#mfa-fatigue","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":79,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L79","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"399f5eb2fe638498d28eb80ce9ba33ce934923ebd68968fdc5fc299e0a365688","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"account challenge sequence.","expected_behavior":"isolated prompts followed by a prompt response.","deviation":"burst of repeated prompts, abnormal inter-arrival times, or unusual denial ratio.","anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}],"log_sources":[{"title":"Multi-Factor Authentication Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#44-multi-factor-authentication-logs"},{"title":"Identity Provider Sign-In Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#39-identity-provider-sign-in-logs"}],"context_references":[{"title":"Scattered Spider joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa23-320a-scattered-spider.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231116.pdf"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Inter-Arrival-Time Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#19-inter-arrival-time-anomaly"},{"title":"Ratio or Proportion Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#20-ratio-or-proportion-anomaly"}],"strategies":[{"id":"DET0160","name":"Detection Strategy for Multi-Factor Authentication Request Generation (T1621)","url":"https://attack.mitre.org/detectionstrategies/DET0160","stix_id":"x-mitre-detection-strategy--5dab1bc7-89e2-4fe4-ae30-40b550d0daf4","relationship_id":"relationship--3061a5d3-7c23-41ff-bc7e-7cd916b4bfc7","description":"","analytics":[{"id":"AN0449","name":"Analytic 0449","guidance":"Monitor for excessive or anomalous MFA push notifications or token requests, especially when login attempts originate from unusual IPs or geolocations and do not correspond to legitimate user-initiated sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0449","platforms":["Identity Provider"],"tuning":[{"field":"TimeWindow","description":"Threshold of MFA prompts per user within a short time period"},{"field":"GeoIPAllowList","description":"Expected login locations for workforce; deviations can be tuned"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"Multiple MFA challenge requests without successful primary login","platforms":["Identity Provider"],"analytic_id":"AN0449","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"NSM:Connections","channel":"PushNotificationSent","platforms":["Identity Provider"],"analytic_id":"AN0449","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0450","name":"Analytic 0450","guidance":"Detect abnormal MFA activity within cloud service provider logs, such as repeated generation of MFA challenges for the same user session or mismatched MFA device and login origin.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0450","platforms":["IaaS"],"tuning":[{"field":"FailedLoginThreshold","description":"Number of failed logins before raising detection"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"AWS:CloudTrail","channel":"AssumeRole or ConsoleLogin with repeated MFA failures followed by repeated MFA requests","platforms":["IaaS"],"analytic_id":"AN0450","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0450","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0451","name":"Analytic 0451","guidance":"Detect repeated failed login events followed by MFA challenges triggered in rapid succession, especially if originating from service accounts or anomalous IP addresses.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0451","platforms":["Windows"],"tuning":[{"field":"ServiceAccountExclusion","description":"Exclude specific accounts where automated MFA requests are legitimate"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"WinEventLog:Security","channel":"EventCode=4625","platforms":["Windows"],"analytic_id":"AN0451","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0451","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0452","name":"Analytic 0452","guidance":"Monitor PAM and syslog entries for unusual frequency of login attempts that trigger MFA prompts, particularly when MFA challenges do not match expected user behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0452","platforms":["Linux"],"tuning":[{"field":"AuthRetryThreshold","description":"Number of retries per user allowed before detection is triggered"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"auditd:AUTH","channel":"pam_unix or pam_google_authenticator invoked repeatedly within short interval","platforms":["Linux"],"analytic_id":"AN0452","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0452","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0453","name":"Analytic 0453","guidance":"Detect anomalous OAuth or SSO logins that repeatedly generate MFA challenges, particularly where MFA approvals are denied or timed out by the user.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0453","platforms":["SaaS"],"tuning":[{"field":"MFAProvider","description":"Identify which MFA service provider logs are in use (Okta, Duo, Microsoft Authenticator)"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"saas:okta","channel":"MFAChallengeIssued","platforms":["SaaS"],"analytic_id":"AN0453","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0453","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0454","name":"Analytic 0454","guidance":"Detect user account logon attempts that trigger multiple MFA challenges through enterprise identity integrations, especially if MFA push requests are generated without successful interactive login.","url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0454","platforms":["macOS"],"tuning":[{"field":"DeviceEnrollmentStatus","description":"Exclude unmanaged macOS devices that use different MFA providers"}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"macos:unifiedlog","channel":"authd generating multiple MFA token requests","platforms":["macOS"],"analytic_id":"AN0454","source_url":"https://attack.mitre.org/detectionstrategies/DET0160#AN0454","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has used repeated MFA requests to gain access to victim accounts.(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)(Citation: NCSC et al APT29 2024)","relationship_id":"relationship--0cb7daf3-9c55-4210-a2a8-c5e40cf4ffbd","references":[{"source_name":"Suspected Russian Activity Targeting Government and Business Entities Around the Globe","description":"Luke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock. (2021, December 6). Suspected Russian Activity Targeting Government and Business Entities Around the Globe. Retrieved April 15, 2022.","url":"https://www.mandiant.com/resources/russian-targeting-gov-business"},{"source_name":"NCSC et al APT29 2024","description":"UK National Cyber Security Center et al. (2024, February). SVR cyber actors adapt tactics for initial cloud access. Retrieved March 1, 2024.","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--a72a96fc-c76e-4c55-9ea6-4315246c15db","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.(Citation: CrowdStrike Scattered Spider BYOVD January 2023)(Citation: Check Point Scattered Spider JUL 2025)","relationship_id":"relationship--a3fef23a-9f22-4d7c-b9f1-3f05372e9d87","references":[{"source_name":"Check Point Scattered Spider JUL 2025","description":"Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source_name":"CrowdStrike Scattered Spider BYOVD January 2023","description":"CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023.","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users to only accept 2FA/MFA requests from login attempts they initiated, to review source location of the login attempt prompting the 2FA/MFA requests, and to report suspicious/unsolicited prompts.","relationship_id":"relationship--f78baa1d-e84a-4f32-a1a4-67972bdd94ea","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Implement more secure 2FA/MFA mechanisms in replacement of simple push or one-click 2FA/MFA options. For example, having users enter a one-time code provided by the login screen into the 2FA/MFA application or utilizing other out-of-band 2FA/MFA mechanisms (such as rotating code-based hardware tokens providing rotating codes that need an accompanying user pin) may be more secure. Furthermore, change default configurations and implement limits upon the maximum number of 2FA/MFA request prompts that can be sent to users in period of time.(Citation: MFA Fatigue Attacks - PortSwigger)","relationship_id":"relationship--3a907723-bc0a-4a35-a9fc-dd45ad7752a8","references":[{"source_name":"MFA Fatigue Attacks - PortSwigger","description":"Jessica Haworth. (2022, February 16). MFA fatigue attacks: Users tricked into allowing device access due to overload of push notifications. Retrieved March 31, 2022.","url":"https://portswigger.net/daily-swig/mfa-fatigue-attacks-users-tricked-into-allowing-device-access-due-to-overload-of-push-notifications"}]},{"id":"M1036","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M1036","kind":"course-of-action","description":"Enable account restrictions to prevent login attempts, and the subsequent 2FA/MFA service requests, from being initiated from suspicious locations or when the source of the login attempts do not match the location of the 2FA/MFA smart device. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.(Citation: Microsoft Common Conditional Access Policies)","relationship_id":"relationship--a09cb233-bdff-4d89-bcc3-7fb2108911d0","references":[{"source_name":"Microsoft Common Conditional Access Policies","description":"Microsoft. (2022, December 14). Conditional Access templates. Retrieved February 21, 2023.","url":"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1621":"/ttp-simulation/techniques/enterprise/T1621/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1621","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}