Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®

Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®
Currently viewing
ATT&CK v17.1
which was live between April 22, 2025 and October 27, 2025.
Learn more about the versioning system
or
see the live site
Techniques
Enterprise
Multi-Factor Authentication Interception
Multi-Factor Authentication Interception
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.
[1]
Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).
[2]
Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.
[3]
ID:
T1111
Sub-techniques:
No sub-techniques
Tactic:
Credential Access
Platforms:
Linux, Windows, macOS
Contributors:
John Lambert, Microsoft Threat Intelligence Center
Version:
2.1
Created:
31 May 2017
Last Modified:
15 April 2025
Version Permalink
Live Version
Procedure Examples
ID
Name
Description
G1044
APT42
APT42
has intercepted SMS-based one-time passwords and has set up two-factor authentication.
[4]
Additionally,
APT42
has used cloned or fake websites to capture MFA tokens.
[5]
G0114
Chimera
Chimera
has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.
[6]
G0094
Kimsuky
Kimsuky
has used a proprietary tool to intercept one time passwords required for two-factor authentication.
[7]
G1004
LAPSUS$
LAPSUS$
has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.
[8]
C0049
Leviathan Australian Intrusions
Leviathan
abused compromised appliance access to collect multifactor authentication token values during
Leviathan Australian Intrusions
[9]
C0014
Operation Wocao
During
Operation Wocao
, threat actors used a custom collection method to intercept two-factor authentication soft tokens.
[10]
S1104
SLOWPULSE
SLOWPULSE
can log credentials on compromised Pulse Secure VPNs during the
DSAuth::AceAuthServer::checkUsernamePassword
ACE-2FA authentication procedure.
[11]
S0018
Sykipot
Sykipot
is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.
[12]
Mitigations
ID
Mitigation
Description
M1017
User Training
Remove smart cards when not in use.
Detection
ID
Data Source
Data Component
Detects
DS0027
Driver
Driver Load
Monitor for use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior. Similar to
Input Capture
, keylogging activity can take various forms but can may be detected via installation of a driver.
Analytic 1 - Unexpected kernel driver installations.
(index=security sourcetype="WinEventLog:System" EventCode=7045) OR(index=os sourcetype="linux_audit" action="add" path="/lib/modules/*/kernel/drivers/" OR path="/etc/udev/rules.d/") OR(index=os sourcetype="macos_secure" message="kextload")
DS0009
Process
OS API Execution
Monitor for API calls associated with polling to intercept keystrokes.
DS0024
Windows Registry
Windows Registry Key Modification
Monitor for changes to windows registry keys or values that may target multi-factor authentication mechanisms, such as smart cards, to gain access to credentials that can be used to access systems, services, and network resources.
Analytic 1 - Unauthorized registry changes related to MFA settings.
index=security sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 | where match(RegistryKeyPath, "(?i)(MFA|2FA|MultiFactorAuth|SmartCard|Token|SecureID|OTP|OneTimePasscode)")
References
Mandiant. (2011, January 27). Mandiant M-Trends 2011. Retrieved January 10, 2016.
Jackson, William. (2011, June 7). RSA confirms its tokens used in Lockheed hack. Retrieved November 17, 2024.
Okta. (2022, August 25). Detecting Scatter Swine: Insights into a Relentless Phishing Campaign. Retrieved February 24, 2023.
Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.
Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.
Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.
MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.
Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.