MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Defense Evasion/ T1556.006

T1556.006Multi-Factor Authentication

T1556.006 — Multi-Factor Authentication is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 13 detection use cases covering it and 2 threat-intel articles citing it.

Defense EvasionPersistenceCredential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

13Use cases

2Articles

0Sub-techniques

3Tactics

↑ Parent technique: T1556 · Modify Authentication Process

Use cases covering this technique (13)

Okta Multi-Factor Authentication Disabled ESCU actions · alerting P PingID Mismatch Auth Source and Verification Response ESCU actions · alerting P PingID New MFA Method After Credential Reset ESCU actions · alerting P PingID New MFA Method Registered For User ESCU actions · alerting P ASL AWS Multi-Factor Authentication Disabled ESCU actions · alerting P ASL AWS New MFA Method Registered For User ESCU actions · alerting P AWS Multi-Factor Authentication Disabled ESCU actions · alerting P AWS New MFA Method Registered For User ESCU actions · alerting P Azure AD Multi-Factor Authentication Disabled ESCU actions · alerting P Azure AD New MFA Method Registered For User ESCU actions · alerting P GCP Multi-Factor Authentication Disabled ESCU actions · alerting P [LLM] Entra helpdesk password reset immediately followed by new MFA method registration (ShinyHunters ATO) Bespoke install · alerting SPDD [LLM] Iran-aligned MFA push-bombing followed by new auth method registered (AA24-290A) Bespoke actions · alerting DSP

Articles citing this technique (2)

high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-10

crit Cyber fallout from the Iran war: What to have on your radar art-593