T1111 — Multi-Factor Authentication Interception

Tactic: Credential Access · Platforms: Linux, macOS, Windows

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and…

Sigma detection rules (3)

T1111 Multi-Factor Authentication Interception

title: T1111 Multi-Factor Authentication Interception
id: 914a531a-4a74-436b-9a45-02e12df51bf3
description: 'Detects process access (memory-read-capable GrantedAccess) targeting winlogon.exe or LogonUI.exe, the processes that handle interactive and smart-card logon, as a proxy for keylogging/PIN-capture or smart-card-proxying activity used to intercept MFA. (Retargeted from the nonexistent security-log EventID 10 pairing to Sysmon ProcessAccess, which is the correct source for this telemetry.) Tune using: AccessMask, ProcessNameExclusions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1111
author: Shahrukh Khan
date: 2026-04-27
license: MIT
tags:
  - attack.credential-access
  - attack.t1111

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    TargetImage|endswith:
      - '\winlogon.exe'
      - '\LogonUI.exe'
    GrantedAccess|contains:
      - '0x1fffff'
      - '0x1410'
      - '0x1010'
      - '0x143a'
  filter_system_account:
    SourceUser|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Security/EDR agents and legitimate credential-provider components that legitimately open handles to winlogon.exe/LogonUI.exe for monitoring purposes.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1111 Multi-Factor Authentication Interception

title: T1111 Multi-Factor Authentication Interception
id: a492747d-41ff-4cb1-816a-f1b3f91e3026
description: 'Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying. Genuine keylogging of smart-card PINs/RSA SecurID codes and OTP interception happens at the input-device/hardware level and has no auditd-visible signature distinct from normal typing -- this is NOT observable via Linux auditd telemetry. The previous version watched PAM config writes (/etc/pam.d/), which is really a T1556 Modify Authentication Process indicator, not MFA interception. Retargeted to the closest defensible Linux-observable proxy for a credential/OTP-interception implant: global LD_PRELOAD hook installation (/etc/ld.so.preload) and unauthorized drops into the PAM module directories, either of which can be used to hook libc input/auth functions and capture credentials or one-time codes as they pass through the authentication stack. Tune using: PathTarget, UserContext, ModuleWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1111
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.credential-access
  - attack.t1111

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection_ld_preload:
    type: PATH
    name|contains: '/etc/ld.so.preload'
    nametype:
      - CREATE
      - NORMAL
  selection_pam_module_drop:
    type: PATH
    name|contains:
      - '/lib/security/'
      - '/lib/x86_64-linux-gnu/security/'
      - '/lib64/security/'
    name|endswith: '.so'
    nametype:
      - CREATE
      - NORMAL

  condition: 1 of selection_*

falsepositives:
  - Legitimate software installs (e.g. some proprietary drivers, security agents) register entries in /etc/ld.so.preload; PAM module directories are also legitimately written to during OS updates and MFA/PAM stack rollout by admins. This rule cannot directly observe hardware-token/OTP interception, so treat it as an indirect persistence-mechanism indicator only.

level: medium

T1111 Multi-Factor Authentication Interception

title: T1111 Multi-Factor Authentication Interception
id: 6ea5fd69-0203-4eca-b64a-eed9ac7333ce
description: 'Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccessibilityAPIUsage, TCCBypassAttempt, SignedBinaryCheck.'
references:
  - https://attack.mitre.org/techniques/T1111
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.credential-access
  - attack.t1111

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/tccutil'
    CommandLine|contains: 'reset Accessibility'

  condition: selection

falsepositives:
  - IT support resetting Accessibility permissions during legitimate troubleshooting; actual MFA interception via Accessibility API abuse is not directly observable in unified log process events.

level: high

Explore