t1111-multi-factor-authentication-interception

name	T1111_multi-factor-authentication-interception
description	Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and netw...
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1111","credential-access","linux","windows","macos"]
technique_id	T1111
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Linux","Windows","macOS"]
mitre_url	https://attack.mitre.org/techniques/T1111
tech_stack	["linux","windows","macos"]
cwe_ids	["CWE-522"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1111 Multi-Factor Authentication Interception

High-Level Description

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.

Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).

Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Linux, Windows, macOS

What to Check

• Identify if Multi-Factor Authentication Interception technique is applicable to target environment
• Check Linux systems for indicators of Multi-Factor Authentication Interception
• Check Windows systems for indicators of Multi-Factor Authentication Interception
• Check macOS systems for indicators of Multi-Factor Authentication Interception
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing