Multi-Factor Authentication Interception
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The brief's Windows analytic AN0687 describes three things and none has an honest single-event observable. Keyboard-capture API calls (SetWindowsHookEx/GetAsyncKeyState) produce no Windows event, and no driver_load source is offered for the keylogger-driver leg -- the one angle that would work (a keyboard class filter driver) is already authored as T1056.001. process_access (EID 10) only has lsass.exe as a meaningful target, which is credential dumping and duplicates T1003/T1003.001, not MFA interception. Security 4624/4648 carry no smart-card indicator -- that signal lives in 4768 CertIssuerName, which the brief does not offer. The Linux/macOS analytics have no standard Sigma field vocabulary.
What the technique is
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). Other methods of MFA may be intercepted and used by an adversary to authenticate. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0687
Behavior chain involving unexpected API calls to capture keyboard input, driver loads for keyloggers, or remote use of smart card authentication via logon sessions not initiated by local user interaction
- AN0688
Detection of unauthorized keylogger behavior through access to /dev/input, loading kernel modules (e.g., via insmod), or polling user input devices from non-user shells
- AN0689
Processes accessing TCC-protected input APIs or polling HID services without user interaction, or dynamically loaded keylogging frameworks using accessibility privileges
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.