Multi-Factor Authentication Request Generation
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every analytic in the brief is a rate condition, and none of the three log sources records an MFA challenge at all. AN0451 counts 'repeated failed login events followed by MFA challenges in rapid succession' on Security EventID 4625, but 4625 is a Windows credential failure -- Status/SubStatus, LogonType, TargetUserName, WorkstationName, IpAddress -- with no field for a push notification, a push approval or a push denial. Standard Windows interactive and network logon does not generate MFA pushes at all; where a third-party agent (Duo for Windows Logon, Okta Verify) does, it writes to its own application channel, not to Security, so the selector would sit on a feed that cannot carry the behaviour. Stripping AN0451 of its 'repeated... […]
What the technique is
Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR). In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0449
Monitor for excessive or anomalous MFA push notifications or token requests, especially when login attempts originate from unusual IPs or geolocations and do not correspond to legitimate user-initiated sessions.
- AN0450
Detect abnormal MFA activity within cloud service provider logs, such as repeated generation of MFA challenges for the same user session or mismatched MFA device and login origin.
- AN0451
Detect repeated failed login events followed by MFA challenges triggered in rapid succession, especially if originating from service accounts or anomalous IP addresses.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.