Tag
eduMFA Token Reusage Vulnerability due to Incorrect InnoDB Snapshot Isolation
2 ruleseduMFA versions prior to 2.9.1 are vulnerable to token reusage due to incorrect InnoDB snapshot isolation in MySQL and MariaDB versions prior to 11.6.2 (or newer with innodb_snapshot_isolation=off), affecting token types such as TOTP, HOTP, and likely WebAuthN, where tokens are intended for single use, requiring racing the transaction for exploitation.
Azure Entra ID MFA TOTP Brute Force Attempted
3 rules 1 TTPIdentifies brute force attempts against Azure Entra multi-factor authentication (MFA) Time-based One-Time Password (TOTP) verification codes, characterized by high-frequency failed attempts for a single user across numerous distinct sessions, potentially indicating programmatic attempts to bypass MFA.
AWS STS AssumeRole with New MFA Device
2 rules 4 TTPsThis rule identifies when a user has assumed a role using a new MFA device in AWS, which can be indicative of persistence and privilege escalation attempts by threat actors.
Successful AWS Console Login Without MFA
2 rules 1 TTPSuccessful AWS console logins without multi-factor authentication can indicate compromised credentials, misconfigured security settings, or unauthorized access attempts.
AWS Virtual MFA Device Registration Attempt
2 rules 1 TTPAn adversary attempts to register a virtual MFA device to an AWS account, potentially leading to account takeover and unauthorized access to resources.
Okta MFA Disabled by User
2 rules 1 TTPDetection of Okta multi-factor authentication (MFA) being disabled by a user account, potentially indicating malicious activity or account compromise and leading to unauthorized access.
Entra ID MFA Disabled for User
2 rules 3 TTPsDetection of multi-factor authentication (MFA) being disabled for an Entra ID user account, potentially weakening account security and leading to compromise.
Azure PIM Role Activation Without MFA
2 rules 1 TTPDetection of Azure Privileged Identity Management (PIM) roles being activated without requiring multi-factor authentication, potentially leading to unauthorized privilege escalation and persistence.
PingID New MFA Method Registered For User
2 rules 3 TTPsThe creation of a new MFA registration in PingID could indicate an attacker attempting to maintain persistence after compromising a user account.
PingID New MFA Method After Credential Reset
2 rules 3 TTPsDetection of a new MFA device pairing in PingID shortly after a password reset in Windows Event Logs, potentially indicating a social engineering attack and unauthorized account access.
Okta Multiple Failed MFA Requests Indicate Potential MFA Bypass Attempt
2 rules 1 TTPAn adversary may attempt to bypass MFA by bombarding a user with repeated authentication requests, potentially leading to unauthorized access and system compromise.
Okta MFA Reset or Deactivation Attempt
2 rules 1 TTPAn attacker attempts to disable or reset multi-factor authentication (MFA) for a user account in Okta, potentially leading to unauthorized access and account compromise.
Okta Authentication Failed During MFA Challenge
2 rules 3 TTPsDetection of failed authentication attempts during Okta MFA challenges, potentially indicating compromised credentials and attempts to bypass MFA.
Office 365 MFA Notification Email Deletion for Defense Evasion
2 rules 1 TTPAttackers may delete multi-factor authentication (MFA) notification emails in Office 365 to evade detection and maintain unauthorized access after compromising an account.
Office 365 MFA Bypass via Trusted IP Modification
2 rules 1 TTPAn adversary modifies the trusted IP list in Office 365 to bypass multi-factor authentication (MFA) and gain unauthorized access to accounts.
GCP Authentication Failure During MFA Challenge
2 rules 2 TTPs 1 IOCDetection of failed MFA challenges in Google Cloud Platform (GCP) using Google Workspace login failure events, potentially indicating credential compromise and unauthorized access attempts.
Azure AD New MFA Method Registered For User
2 rules 2 TTPsAn adversary may register a new MFA method in Azure AD on a compromised account to maintain persistence and bypass existing security controls.
Azure AD Multiple Denied MFA Requests Indicating Potential Account Compromise
2 rules 2 TTPsDetection of an unusually high number of denied MFA requests for a single user within a short timeframe in Azure AD, potentially indicating a targeted account compromise attempt.
Azure AD MFA Fatigue Attack
2 rules 2 TTPsAn attacker attempts to bypass multi-factor authentication by flooding a user with MFA requests, potentially leading to account compromise.
Azure AD MFA Disabled to Bypass Authentication
2 rules 1 TTPAn adversary may disable multi-factor authentication (MFA) in Azure Active Directory to weaken an organization's security posture and bypass authentication mechanisms, potentially gaining unauthorized access to sensitive resources and maintaining persistence.
Azure AD Authentication Failed During MFA Challenge
3 rules 3 TTPsDetection of failed authentication attempts against an Azure AD tenant during the MFA challenge, specifically flagged by error code 500121, leveraging Azure AD SignInLogs, which may indicate an adversary attempting to authenticate using compromised credentials on an account with MFA enabled, potentially leading to unauthorized access.
AWS Multi-Factor Authentication Disabled
2 rules 3 TTPsDetection of AWS Multi-Factor Authentication (MFA) being disabled for an IAM user, indicating potential weakening of account security and persistence attempts.
AWS IAM MFA Device Deactivation
2 rules 3 TTPsDetection of AWS IAM MFA device deactivation via the `DeactivateMFADevice` API call, which could indicate an attempt to weaken account protections for privilege escalation or persistence.
AWS Console Login Failed During MFA Challenge
2 rules 2 TTPsDetection of failed AWS console login attempts despite successful MFA usage, indicating potential account compromise attempts.
AWS Account Compromise via New MFA Registration
2 rules 2 TTPsAn adversary may register a new Multi-Factor Authentication (MFA) method for an AWS account using the `CreateVirtualMFADevice` event in AWS CloudTrail logs to maintain persistence and evade detection in a compromised AWS account.
AWS MFA Bombing Attack Attempt
2 rules 2 TTPsAn attacker attempts to bypass MFA by flooding a user with authentication requests on the AWS console, as detected through AWS CloudTrail logs showing multiple failed MFA attempts within a short timeframe.
O365 MFA Disabled by User
2 rules 1 TTPDetection of Multi-Factor Authentication (MFA) being disabled for a user account in Office 365, potentially indicating malicious activity or an insider threat.
PingID MFA Bombing Attack
1 rule 3 TTPsAdversaries attempt to bypass multi-factor authentication by flooding users with push notifications, hoping they will eventually accept a fraudulent request, potentially leading to unauthorized access.
Google Workspace MFA Enforcement Disabled
2 rules 3 TTPsDetection of multi-factor authentication (MFA) enforcement being disabled for Google Workspace users, potentially weakening security controls and leading to account compromise.
GCP Multi-Factor Authentication Disabled
2 rules 2 TTPsDetection of disabled multi-factor authentication (MFA) for a Google Cloud Platform (GCP) user, potentially leading to unauthorized access and data exfiltration.
AWS IAM Key Creation with Encryption Policy but Without MFA
2 rules 2 TTPsDetection of AWS IAM users creating access keys with encryption policies applied while failing to use multi-factor authentication, potentially indicating compromised accounts or malicious privilege escalation.
GCP Multiple Failed MFA Requests Imply MFA Fatigue Attack
2 rules 3 TTPsDetection of multiple failed multi-factor authentication (MFA) requests for a single user in Google Cloud Platform (GCP) within a short time window, potentially indicating an MFA fatigue attack attempting to bypass MFA and gain unauthorized access.
Azure AD Multi-Factor Authentication Disabled
2 rules 2 TTPsDetection of attempts to disable multi-factor authentication (MFA) for an Azure AD user by identifying the 'Disable Strong Authentication' operation in Azure Active Directory AuditLogs, which allows adversaries to maintain persistence.