Azure Sign-in Logs: MFA Denied AuthenticationRequirement

title: "Azure Sign-in Logs: MFA Denied AuthenticationRequirement"
id: e615b6a8-8e2a-4e99-ab73-f4898c894368
status: test
description: This rule flags Azure sign-in events where the authentication requirement is set to multiFactorAuthentication and the sign-in status contains "MFA Denied." Attackers who have obtained account passwords may attempt to trigger MFA prompts and cause denial or failure to impede successful authentication. The detection relies on Azure sign-in log fields for AuthenticationRequirement and the status text containing "MFA Denied."
references:
  - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_mfa_denies.yml
author: AlertIQ, Huntrule Team
date: 2022-03-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
  - attack.t1621
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AuthenticationRequirement: multiFactorAuthentication
    Status|contains: MFA Denied
  condition: selection
falsepositives:
  - Users actually login but miss-click into the Deny button when MFA prompt.
level: medium
license: DRL-1.1
related:
  - id: e40f4962-b02b-4192-9bfe-245f7ece1f99
    type: derived