Multifactor Authentication Denied

Title: Multifactor Authentication Denied
Status: test
Description:User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
References:
  -https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Author: AlertIQ
Date: 2022-03-24
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.credential-access'
• -'attack.stealth'
• -'attack.t1078.004'
• -'attack.t1110'
• -'attack.t1621'

Logsource:

• product: azure
• service: signinlogs

Detection:
  selection:
    AuthenticationRequirement: 'multiFactorAuthentication'
    Status|contains: 'MFA Denied'
  condition:selection
Falsepositives:
  -Users actually login but miss-click into the Deny button when MFA prompt.
Level: medium