Sunturai
Back to results
MediumSplunk security contentMauricio Velazco +2

Azure AD Multiple Failed MFA Requests For User

The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. It leverages Azure AD Sign-in Logs, specifically error code 500121, to detect…

Description

The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. It leverages Azure AD Sign-in Logs, specifically error code 500121, to detect more than 10 failed MFA attempts within 10 minutes. This behavior is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication prompts. If confirmed malicious, this activity could lead to unauthorized access, allowing attackers to compromise user accounts and potentially escalate their privileges within the environment.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderLinuxmacOSOffice SuitePRESaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
azure_active_directory_sign_in_activity

Known benign triggers

  • Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice