T1621 — Multi-Factor Authentication Request Generation

Tactic: Credential Access · Platforms: Windows, Linux, macOS, IaaS, SaaS, Office Suite, Identity Provider

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Adversaries in possession of credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA…

Sigma detection rules (6)

title: T1621 Multi-Factor Authentication Request Generation
id: fa0c0942-a0d5-4fa6-bc33-5f5632b08619
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621): flags repeated Windows logon/Kerberos pre-authentication failures for a single account, the on-host precursor signal for MFA-bombing/push-spam abuse of valid credentials (the MFA push accept/deny itself is only visible in the IdP''s own logs, not native Windows Security events). This single-event rule is a baseline; pair it with an event_count correlation (group by TargetUserName, timespan 5m, gte 5) for true bombing detection. Tune using: ServiceAccountExclusion.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - '4625'
      - '4771'
  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - A single user mistyping their password a few times; System and service accounts performing the same action are excluded via filter_system_account; this rule alone will be noisy without the recommended event_count correlation -- tune threshold/window if pairing with correlation.

level: medium

title: T1621 Multi-Factor Authentication Request Generation
id: b9cefe84-637c-4bc3-953c-88fc0ad20808
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621) / MFA Fatigue. The prior version declared logsource service: syslog while its detection fields (type: USER_AUTH, grantors) are actually Linux Audit/auditd-specific, an inconsistent logsource; it also alerted on a single failed pam_google_authenticator event, which captures one MFA failure rather than the repeated push/notification spam that actually defines MFA fatigue abuse. Fixed the logsource to auditd and added a companion event_count correlation requiring several failed MFA factor attempts for the same account within a short window, approximating genuine push-bombing rather than an isolated failure. Tune using: AuthRetryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-03-30
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  category: authentication
  product: linux
  service: auditd

detection:
  selection:
    type: USER_AUTH
    grantors|contains: 'pam_google_authenticator'
    res: 'failed'

  condition: selection

falsepositives:
  - A single failed MFA factor is common with normal user typos or a slow authenticator app; genuine MFA-fatigue/push-bombing confirmation requires the paired correlation rule counting repeated failures for the same account within a short window.

level: low
---
title: T1621 MFA Request Generation - Repeated Authentication Failures
id: 2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f
description: 'Correlation companion for b9cefe84-637c-4bc3-953c-88fc0ad20808: counts repeated pam_google_authenticator failures for the same account within a 5-minute window, approximating MFA push-notification-bombing/fatigue behavior that a single failed-auth event cannot establish.'
status: experimental
correlation:
  type: event_count
  rules:
    - b9cefe84-637c-4bc3-953c-88fc0ad20808
  group-by:
    - acct
  timespan: 5m
  condition:
    gte: 5

level: high

title: T1621 Multi-Factor Authentication Request Generation
id: 6533c988-e6c2-44b9-bd5a-5c4cbe03c17f
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DeviceEnrollmentStatus.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/SecurityAgent'

  condition: selection

falsepositives:
  - MFA prompt bombing largely occurs at the identity provider or MDM layer rather than the local macOS unified log, so this rule can only weakly infer repeated authentication prompts and will miss most cloud-based push-bombing entirely.

level: medium

title: T1621 Multi-Factor Authentication Request Generation
id: 45ef68d2-7f2b-4429-a966-7e30da949e32
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FailedLoginThreshold.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    errorCode: 'Failure'

  condition: selection

falsepositives:
  - Users repeatedly mistyping MFA codes due to authenticator clock drift; reliably detecting an MFA push-bombing pattern requires a repeated-failure threshold over a time window, which needs a correlation rule layered on top of this base detection.

level: medium

title: T1621 Multi-Factor Authentication Request Generation
id: e5c3dd22-19d5-4662-9ea1-68eb0004edac
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MFAProvider.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-03-05
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  product: saas
  service: okta

detection:
  selection_bypass_attempt:
    eventType: 'user.mfa.attempt_bypass'
  selection_repeated_push:
    eventType: 'user.authentication.auth_via_mfa'
    outcome.result: 'FAILURE'

  condition: selection_bypass_attempt or selection_repeated_push

falsepositives:
  - A user repeatedly mistapping a push notification on a poor connection; distinguishing this from an MFA-fatigue bombing attempt benefits from a push-count-per-minute threshold.

level: high

title: T1621 Multi-Factor Authentication Request Generation
id: 28ce929f-78f2-4697-9aee-e1ec7b6a5998
description: 'Detection Strategy for Multi-Factor Authentication Request Generation (T1621). (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: TimeWindow, GeoIPAllowList.'
references:
  - https://attack.mitre.org/techniques/T1621
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.credential-access
  - attack.t1621

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType:
      - '50074'
      - '50072'
      - '50079'

  condition: selection

falsepositives:
  - Users repeatedly denying legitimate MFA prompts due to unfamiliarity with a newly rolled out authenticator app, generating a burst of failures; distinguishing an intentional fatigue attack from accidental denials requires a count threshold best expressed as a correlation rule.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1621 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan