Threat video1:00
Microsoft 365/Entra ID MFA Bypass: Detection & IOCs
Victims approve an attacker's device code on Microsoft's real sign-in page, so no password is stolen. 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft 365/Entra ID MFA Bypass: Detection & IOCs →
Chapters
- 0:00The hookDevice code phishing bypasses your MFA.
- 0:04The storyA law-firm lure arrives.
- 0:11Attack pathLaw firm sender, redirected to device-code page.
- 0:26AttributionNo threat actor is attributed.
- 0:30Indicators of compromise16 indicators to hunt: 5 IPs, 5 domains and 6 URLs.
- 0:37MITRE ATT&CK techniques11 ATT&CK techniques, from resource development to collection.
- 0:42Remediation3 steps now: Block the listed sender domains, redirector URLs, phishing endpoints.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Device code phishing bypasses your MFA.
0:05A law-firm lure arrives.
0:06You enter your device code.
0:11Law firm sender, redirected to device-code page.
0:15Victim enters code on genuine Microsoft site.
0:18Attacker gets tokens, registers devices, hides inbox rules.
0:26No threat actor is attributed. Confidence: low.
0:3116 indicators to hunt: 5 IPs, 5 domains and 6 URLs.
0:3811 ATT&CK techniques, from resource development to collection.
0:433 steps now: Block the listed sender domains, redirector URLs, phishing endpoints.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.