Skip to content

Hide Navigation Hide TOC

Multifactor Authentication Denied (e40f4962-b02b-4192-9bfe-245f7ece1f99)

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Cluster A Galaxy A Cluster B Galaxy B Level
Multi-Factor Authentication Request Generation - T1621 (954a1639-f2d6-407d-aef3-4917622ca493) Attack Pattern Multifactor Authentication Denied (e40f4962-b02b-4192-9bfe-245f7ece1f99) Sigma-Rules 1
Multifactor Authentication Denied (e40f4962-b02b-4192-9bfe-245f7ece1f99) Sigma-Rules Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65) Attack Pattern 1
Multifactor Authentication Denied (e40f4962-b02b-4192-9bfe-245f7ece1f99) Sigma-Rules Brute Force - T1110 (a93494bb-4b80-4ea1-8695-3236a49916fd) Attack Pattern 1
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65) Attack Pattern 2