<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-mfa-bypass-detection
description: >-
  Detect MFA bypass techniques including MFA fatigue attacks, adversary-in-the-middle
  proxy interception, SIM swapping, device code phishing, legacy protocol bypass,
  and session token theft post-authentication.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - mfa
  - mfa-bypass
  - evilginx
  - aitm
  - push-fatigue
  - session-hijacking
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1111"]
---

# Implementing MFA Bypass Detection

## Overview

MFA is not a silver bullet. Sophisticated attackers bypass MFA through adversary-in-the-middle
(AiTM) proxies like Evilginx2 that capture session tokens post-authentication, MFA fatigue
(T1621) push spam, device code phishing in OAuth flows, legacy protocol bypass via IMAP/POP3,
and SIM swapping for SMS-based MFA. This skill builds detection rules for each vector.

Mode: `[MODE: PURPLE]` — Maps bypass techniques to detection opportunities.

MITRE ATT&CK: T1621 (Multi-Factor Authentication Request Generation), T1111 (Multi-Factor Authentication Interception)

## Prerequisites

- SIEM with Azure AD / Entra ID sign-in logs or equivalent IdP logs
- Conditional Access audit logs
- Network proxy logs (for AiTM detection)
- Python 3.10+ with `pandas`, `requests`

## Key Concepts

### MFA Bypass Taxonomy

| Technique | Detection Signal | Difficulty |
|-----------|-----------------|------------|
| MFA Fatigue (Push Spam) | Multiple MFA prompts in short window | Medium |
| AiTM Proxy (Evilginx2) | Session token from non-compliant device/unusual IP | Hard |
| Device Code Phishing | Device code auth from unexpected location | Medium |
| Legacy Protocol Bypass | IMAP/POP3/SMTP auth without MFA | Easy |
| SIM Swap | Phone number change + immediate MFA reset | Medium |
| Recovery Code Abuse | Backup code used instead of primary MFA | Easy |
| Session Token Theft | Token replay from different device fingerprint | Hard |

### Sigma Detection Rules

```yaml
title: MFA Fatigue — Multiple Push Notifications
id: c5d4e3f2-3456-7890-bcde-f01234567890
status: experimental
description: Detects repeated MFA push prompts indicating fatigue attack
logsource:
  category: authentication
  product: azure
detection:
  selection:
    ResultType: 500121
    AuthenticationRequirement: multiFactorAuthentication
  timeframe: 5m
  condition: selection | count() by UserPrincipalName > 5
falsepositives:
  - User with connectivity issues retrying MFA
level: high
tags:
  - attack.t1621
  - attack.credential_access
```

```yaml
title: AiTM Session Token — Non-Compliant Device After MFA
id: d6e5f4a3-4567-8901-cdef-012345678901
status: experimental
description: Detects successful MFA followed by access from non-compliant device
logsource:
  category: authentication
  product: azure
detection:
  selection:
    ResultType: 0
    AuthenticationRequirement: multiFactorAuthentication
  filter:
    DeviceDetail.isCompliant: false
    DeviceDetail.isManaged: false
  condition: selection and filter
falsepositives:
  - BYOD devices not yet enrolled
level: high
tags:
  - attack.t1111
  - attack.credential_access
```

### Splunk Detection Queries

```spl
# MFA fatigue detection
index=azure_ad sourcetype=azure:aad:signin
  ResultType=500121
| bin _time span=5m
| stats count by UserPrincipalName _time
| where count > 5

# Legacy protocol authentication (bypasses MFA)
index=azure_ad sourcetype=azure:aad:signin
  ClientAppUsed IN ("IMAP", "POP3", "SMTP", "Exchange ActiveSync", "Other clients")
  ResultType=0
| stats count by UserPrincipalName ClientAppUsed src_ip

# Session anomaly — impossible travel
index=azure_ad sourcetype=azure:aad:signin ResultType=0
| iplocation src_ip
| sort UserPrincipalName _time
| streamstats current=f last(Country) as prev_country last(_time) as prev_time by UserPrincipalName
| eval time_diff=_time-prev_time
| where Country!=prev_country AND time_diff < 3600
```

## Workflow

### Step 1: Configure Log Sources

```bash
# Enable Azure AD sign-in log streaming to SIEM
az monitor diagnostic-settings create \
  --name "SignInLogs" \
  --resource "/providers/Microsoft.aadiam" \
  --logs '[{"category":"SignInLogs","enabled":true}]' \
  --workspace WORKSPACE_ID

# Enable MFA registration and usage logs
az monitor diagnostic-settings create \
  --name "MFALogs" \
  --resource "/providers/Microsoft.aadiam" \
  --logs '[{"category":"NonInteractiveUserSignInLogs","enabled":true},{"category":"ManagedIdentitySignInLogs","enabled":true}]' \
  --workspace WORKSPACE_ID
```

### Step 2: Deploy Detection Rules

```bash
node scripts/agent.js --input /tmp/signin_logs.json --output /tmp/mfa_bypass_findings.json
node scripts/agent.js --input /tmp/signin_logs.json --detect-fatigue --threshold 5
```

### Step 3: Validate Detections

```bash
# Simulate MFA fatigue (authorized test)
# Generate multiple MFA prompts for test account
# Verify SIEM alert fires within expected timeframe

# Test legacy protocol detection
# Attempt IMAP login with app password
# Verify detection rule triggers
```

## Verification

- [ ] MFA fatigue detection alerts on >5 prompts per user in 5-minute window
- [ ] Legacy authentication protocols blocked via Conditional Access
- [ ] AiTM detection correlates device compliance with session creation
- [ ] Impossible travel detection tuned with org-specific thresholds
- [ ] Device code phishing detection monitors for unusual device code grants
- [ ] Number matching enabled for push MFA (defeats fatigue attacks)
- [ ] Phishing-resistant MFA (FIDO2/passkeys) deployed for privileged accounts
- [ ] Session token binding to device implemented where supported

## References

- [Microsoft — Defend Against MFA Fatigue](https://learn.microsoft.com/en-us/entra/identity/authentication/concepts-authentication-default-mfa)
- [MITRE ATT&CK T1621](https://attack.mitre.org/techniques/T1621/)
- [Evilginx2 — AiTM Phishing Framework](https://github.com/kgretzky/evilginx2)
- [CISA — Phishing-Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
