Detecting and Mitigating MFA Fatigue Attacks (T1621)

Multi-Factor Authentication Request Generation (T1621) is a Credential Access technique. MITRE lists Windows, Linux, macOS, IaaS, SaaS, Office Suite and Identity Provider as platforms. Adversaries generate MFA requests to the people they are trying to impersonate and wait for someone to approve one.

It targets the weakest part of an otherwise strong control: a tired person holding a phone.

How attackers use it

An adversary with a valid username and password (Valid Accounts, T1078) may be stuck at the second factor. To get past it, they abuse the automatic push notifications sent by services such as Duo Push, Microsoft Authenticator or Okta, hoping the user grants access.

If they do not have the password, MITRE adds that they may abuse automatic push generation when it is configured for self-service password reset (SSPR).

In some cases the adversary repeats login attempts continuously, flooding the user with push notifications, SMS messages and phone calls until the person accepts a request, which MITRE calls MFA fatigue.

Procedure examples on the page: APT29 used repeated MFA requests to access victim accounts. LAPSUS$ spammed target users with MFA prompts. Scattered Spider sent repeated MFA authentication requests, and in a campaign tagged C0027 continuously sent messages until the victim accepted the push challenge.

How to detect it

MITRE gives several analytics. They share a pattern: a burst of MFA challenges that the user did not start.

• Excessive or unusual MFA push notifications or token requests, especially when logins come from unusual IP addresses or locations and do not match a session the user began.
• Repeated MFA challenges for the same user session, or mismatches between the MFA device and where the login came from, visible in cloud provider logs.
• Repeated failed logins followed by quick MFA challenges, especially from service accounts or unusual IPs.
• Unusual frequency of login attempts that trigger MFA prompts in PAM and syslog entries on Linux.
• Single sign-on or OAuth logins that repeatedly generate challenges, particularly when the user denies them or they time out.
• Logon attempts that trigger several MFA challenges through identity integrations, with push requests generated but no successful interactive login.

In practice, build one alert on the count of MFA challenges per user in a short window, and another on MFA denials or timeouts followed by a success. The second pattern is the shape of a fatigue attack that worked.

Also give people a way to report prompts. A user who got ten prompts at midnight is your fastest sensor, as long as they know whom to tell.

How to reduce the risk

MITRE lists three mitigations.

1. Use stronger MFA than simple push. Replace one tap approval with a method that makes the user enter a one time code shown on the login screen, or use out of band methods such as rotating code hardware tokens that also need a PIN. Change default configurations and set limits on how many MFA prompts can be sent to a user in a given period.
2. Apply account use policies. Restrict login attempts, and the MFA requests that follow, from suspicious locations or when the login source does not match the location of the MFA device. Use conditional access to block logins from non-compliant devices or from outside defined organization IP ranges.
3. Train users. Teach people to accept an MFA request only for a login they started, to check the source location, and to report unsolicited prompts.

Check your own environment

• Which MFA method does each group of users have? Is anyone still on plain push approval?
• Is number matching or code entry turned on where your provider supports it?
• Is there a cap on prompts per user per hour?
• Is SSPR configured to send push or SMS prompts, and who can trigger it?
• Do sign-in logs record denied and timed out MFA challenges, and does anyone review them?
• Does your help desk have a script for a user who says they keep getting prompts?

Quick check

Sources

• MITRE ATT&CK T1621 Multi-Factor Authentication Request Generation