Suspicious Multifactor Authentication Denied (via signinlogs)

title: Suspicious Multifactor Authentication Denied (via signinlogs)
id: 33f61648-49f8-556d-b489-b20781c9c58b
status: stable
description: This rule detects user has indicated they haven't instigated the MFA prompt and could indicate an adversary has the password for the account.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
author: Huntrule Team
date: 2026-06-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
    - attack.t1621
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationRequirement: 'multiFactorAuthentication'
        Status|contains: 'MFA Denied'
    condition: selection
falsepositives:
    - Unknown
level: medium