IA-B-13Level 1 · Signal
Attempts to bypass MFA
A risky behavior signal from the identity provider: the person tried to skip multi-factor authentication through legacy protocols, repeated bypass codes or exception requests.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AA-03
- MITRE ATT&CK
-
- T1556
The definition, in detail
Definition
The behavior weakens the control that stops credential abuse.
Example
A sales rep asks the help desk for a temporary MFA bypass code for the third time in a month because he finds the prompts slow.
How it is measured
- Source
- Identity provider & MFA
- Subject
- Person
- Event
- mfa.bypass.attempted
- Risk domain
- Identity and access
- Provenance
- Framework research
How it is used
Programs count "Attempts to bypass MFA" per person from Identity provider & MFA and read it beside the other Identity and access signals; it feeds 0 cohorts, 0 sequences and 1 breach scenario.
A "attempts to bypass MFA" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0024Sends credentials through chat messages
- I.0047Accepts voice call MFA code requests over SMS
- I.0048Shares OTP or MFA codes via email or chat messages
- I.0049Approves suspicious or fraudulent MFA requests
- I.0105Logs into enterprise services using personal accounts
- I.0106Shows simultaneous logins from geographically distant IPs
- I.0107Continues using expired credentials for cloud access
- I.0108Avoids enterprise single sign-on
- I.0111Stores unencrypted credentials in shared cloud folders
- I.0127Uses root credentials for cloud administrative access
- I.0138Misuses elevated privileges to access sensitive resources
- I.0139Abuses access privileges in ways that do not comply with policy
- I.0140Steals or harvests credentials using unauthorized tools
- I.0141Accesses protected resources from unusual locations
- I.0147Relies on insecure or temporary credentials to maintain access
- I.0149Engages in activity inconsistent with approved roles
- I.0151Accesses secrets or vaults in unauthorized or unusual ways
- I.0153Uses weak or bypassed authentication methods to gain access
- I.0154Accesses protected resources at unusual volumes or frequency
- I.0170Signs into corporate apps from unapproved devices or locations
- I.0172Bypasses SSO to access SaaS platforms directly
- I.0295Logs in during unusual remote work hours
- I.0296Generates repeated remote login failures
- I.0297Shares corporate credentials with household members
- I.0306Reuses home network credentials on corporate systems
- I.0312Uses shared household accounts on corporate devices
- I.0314Uses outdated or insecure VPN protocols
- I.0319Connects from unsecured or unknown Wi-Fi networks
- I.0362Ignores breach-intel notifications beyond SLA
Continue exploring
"Attempts to bypass MFA" (IA-B-13), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ia-b-13-attempts-to-bypass-mfa
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.