Suspicious Multifactor Authentication Interrupted (via signinlogs)

title: Suspicious Multifactor Authentication Interrupted (via signinlogs)
id: a1751a65-0cd6-5ebe-944c-9d7839561b8a
status: stable
description: This rule detects user login with multifactor authentication failures, which might be an indication an adversary has the password for the account but can't pass the MFA challenge.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: Huntrule Team
date: 2026-07-14
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
    - attack.t1621
logsource:
    product: azure
    service: signinlogs
detection:
    selection_50074:
        ResultType: 50074
        ResultDescription|contains: 'Strong Auth required'
    selection_500121:
        ResultType: 500121
        ResultDescription|contains: 'Authentication failed during strong authentication request'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium