Azure Sign-in Log MFA Interrupted via Strong Auth Failures
Identifies Azure sign-ins that fail during strong/MFA authentication, suggesting blocked credential attempts.
- Product
- azure
- Service
- signinlogs
- Author
- AlertIQ (SigmaHQ), DRL 1.1
- Published
- 2021-10-10
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Azure sign-in attempts where strong authentication (MFA) was required and the strong authentication request failed. Such events can indicate an attacker has obtained valid credentials but cannot complete the MFA challenge. The detection relies on sign-in log fields matching specific result codes and result descriptions for strong authentication requirement and failure.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure Sign-in Log MFA Interrupted via Strong Auth Failures
id: d9dee942-ebab-4bd2-804c-2be3ecfd1647
status: test
description: This rule identifies Azure sign-in attempts where strong authentication (MFA) was required and the strong authentication request failed. Such events can indicate an attacker has obtained valid credentials but cannot complete the MFA challenge. The detection relies on sign-in log fields matching specific result codes and result descriptions for strong authentication requirement and failure.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-18
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
- attack.t1621
logsource:
product: azure
service: signinlogs
detection:
selection_50074:
ResultType: 50074
ResultDescription|contains: Strong Auth required
selection_500121:
ResultType: 500121
ResultDescription|contains: Authentication failed during strong authentication request
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 5496ff55-42ec-4369-81cb-00f417029e25
type: derived