Azure Sign-in Logs: MFA Strong Authentication Failures (Strong Auth Interrupted)

title: "Azure Sign-in Logs: MFA Strong Authentication Failures (Strong Auth Interrupted)"
id: d9dee942-ebab-4bd2-804c-2be3ecfd1647
status: test
description: This rule flags Azure AD sign-in events where MFA/strong authentication was required but the authentication attempt failed during the strong authentication request. Attackers may have valid credentials yet be blocked by the MFA challenge, making repeated MFA failures a useful signal of credential access attempts. It relies on Azure sign-in log fields indicating “Strong Auth required” and “Authentication failed during strong authentication request,” matched by ResultType and message content.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
  - attack.t1621
logsource:
  product: azure
  service: signinlogs
detection:
  selection_50074:
    ResultType: 50074
    ResultDescription|contains: Strong Auth required
  selection_500121:
    ResultType: 500121
    ResultDescription|contains: Authentication failed during strong authentication request
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5496ff55-42ec-4369-81cb-00f417029e25
    type: derived