From e39385fb3409d672acd387f8453926be6459bc48 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 15:42:16 -0700 Subject: [PATCH 1/8] new_mfa_Detections --- ...sole_login_failed_during_mfa_challenge.yml | 69 +++++++++++++++++++ ...login_failed_during_mfa_challenge.test.yml | 13 ++++ 2 files changed, 82 insertions(+) create mode 100644 detections/cloud/aws_console_login_failed_during_mfa_challenge.yml create mode 100644 tests/cloud/aws_console_login_failed_during_mfa_challenge.test.yml diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml new file mode 100644 index 0000000000..b08192c6a8 --- /dev/null +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -0,0 +1,69 @@ +name: AWS Console Login Failed During MFA Challenge +id: 55349868-5583-466f-98ab-d3beb321961e +version: 1 +date: '2022-10-03' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +- Endpoint +description: The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. +search: '`cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes" +| stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode errorMessage + userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `aws_console_login_failed_during_mfa_challenge_filter`' +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. +references: +- https://attack.mitre.org/techniques/T1621/ +- https://aws.amazon.com/what-is/mfa/ +tags: + analytic_story: + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json + impact: 80 + kill_chain_phases: + - Exploitation + message: User $user_name$ failed to pass MFA challenge while logging into console from $src$ + mitre_attack_id: + - T1621 + nist: + - DE.CM + observable: + - name: user_name + type: User + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - src + - eventName + - eventSource + - aws_account_id + - errorCode + - errorMessage + - userAgent + - eventID + - awsRegion + - user_name + - userIdentity.arn + risk_score: 64 + security_domain: threat diff --git a/tests/cloud/aws_console_login_failed_during_mfa_challenge.test.yml b/tests/cloud/aws_console_login_failed_during_mfa_challenge.test.yml new file mode 100644 index 0000000000..8044aaa32b --- /dev/null +++ b/tests/cloud/aws_console_login_failed_during_mfa_challenge.test.yml @@ -0,0 +1,13 @@ +name: AWS Console Login Failed During MFA Challenge Unit Test +tests: +- name: AWS Console Login Failed During MFA Challenge + file: cloud/aws_console_login_failed_during_mfa_challenge.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From 07a9ec11c90f0e05edf7b38efa2ce2adc048c935 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 16:48:23 -0700 Subject: [PATCH 2/8] new detectoion --- ..._multiple_failed_mfa_requests_for_user.yml | 48 +++++++++++++++++++ ...iple_failed_mfa_requests_for_user.test.yml | 13 +++++ 2 files changed, 61 insertions(+) create mode 100644 detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml create mode 100644 tests/cloud/aws_multiple_failed_mfa_requests_for_user.test.yml diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml new file mode 100644 index 0000000000..717fb58eda --- /dev/null +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -0,0 +1,48 @@ +name: AWS Multiple Failed MFA Requests For User +id: 1fece617-e614-4329-9e61-3ba228c0f353 +version: 1 +date: '2022-10-03' +author: Bhavin Patel +type: Anomaly +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: ' | `aws_multiple_failed_mfa_requests_for_user_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: UPDATE value between 1-100 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: threat diff --git a/tests/cloud/aws_multiple_failed_mfa_requests_for_user.test.yml b/tests/cloud/aws_multiple_failed_mfa_requests_for_user.test.yml new file mode 100644 index 0000000000..9646b568bc --- /dev/null +++ b/tests/cloud/aws_multiple_failed_mfa_requests_for_user.test.yml @@ -0,0 +1,13 @@ +name: AWS Multiple Failed MFA Requests For User Unit Test +tests: +- name: AWS Multiple Failed MFA Requests For User + file: cloud/aws_multiple_failed_mfa_requests_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 73d060d0af9bf870cf4344224532c85340c20a77 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 16:53:18 -0700 Subject: [PATCH 3/8] updated metadata --- ..._multiple_failed_mfa_requests_for_user.yml | 60 ++++++++++++------- 1 file changed, 39 insertions(+), 21 deletions(-) diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index 717fb58eda..55eb69575b 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -4,45 +4,63 @@ version: 1 date: '2022-10-03' author: Bhavin Patel type: Anomaly -datamodel: -- Endpoint -description: UPDATE_DESCRIPTION -search: ' | `aws_multiple_failed_mfa_requests_for_user_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +datamodel: [] +description: The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others. +search: '`cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication" | bucket span=5m _time +| stats dc(_raw) as mfa_prompts values(userAgent) as userAgent values(src) as src by _time user_name user_arn aws_account_id eventName errorMessage | `aws_multiple_failed_mfa_requests_for_user_filter`' +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. references: -- REFERENCE +- https://attack.mitre.org/techniques/T1621/ +- https://aws.amazon.com/what-is/mfa/ tags: analytic_story: - - UPDATE_STORY_NAME - asset_type: UPDATE asset_type + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 80 context: - - Update context + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force dataset: - - UPDATE_DATASET_URL - impact: UPDATE value between 1-100 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail.json + impact: 80 kill_chain_phases: - Exploitation - message: UPDATE message + message: User $user_name$ failed to pass MFA challenge while logging into console from $src$ mitre_attack_id: - - T1003.002 + - T1621 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: user_name + type: User role: - - UPDATE + - Victim + - name: src + type: IP Address + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 - security_domain: threat + - src + - eventName + - eventSource + - aws_account_id + - errorCode + - errorMessage + - userAgent + - eventID + - awsRegion + - user_name + - userIdentity.arn + risk_score: 64 + security_domain: threat \ No newline at end of file From 089360cee2da4920bd50a89b6981d91b4c6ac005 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 16:53:35 -0700 Subject: [PATCH 4/8] mionr --- detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index 55eb69575b..574593d0d1 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -32,7 +32,7 @@ tags: impact: 80 kill_chain_phases: - Exploitation - message: User $user_name$ failed to pass MFA challenge while logging into console from $src$ + message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time. mitre_attack_id: - T1621 nist: From ad0e59da0eeeb809c24090e5dddb0490024808de Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 3 Oct 2022 17:11:20 -0700 Subject: [PATCH 5/8] yaml error --- .../cloud/aws_console_login_failed_during_mfa_challenge.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index b08192c6a8..b40a10abcb 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -5,7 +5,6 @@ date: '2022-10-03' author: Bhavin Patel, Splunk type: TTP datamodel: [] -- Endpoint description: The following analytic identifies an authentication attempt event against an AWS Console that fails during the Multi Factor Authentication challenge. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. search: '`cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes" | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode errorMessage From 47b0525a18a68ab6367f92edfcc139dd5a287b2d Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 4 Oct 2022 11:50:03 -0700 Subject: [PATCH 6/8] mfa_disabled --- ...s_multi_factor_authentication_disabled.yml | 73 +++++++++++++++++++ ...ti_factor_authentication_disabled.test.yml | 13 ++++ 2 files changed, 86 insertions(+) create mode 100644 detections/cloud/aws_multi_factor_authentication_disabled.yml create mode 100644 tests/cloud/aws_multi_factor_authentication_disabled.test.yml diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml new file mode 100644 index 0000000000..3172088b23 --- /dev/null +++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml @@ -0,0 +1,73 @@ +name: AWS Multi-Factor Authentication Disabled +id: 374832b1-3603-420c-b456-b373e24d34c0 +version: 1 +date: '2022-10-04' +author: Bhavin Patel, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies an attempt to disable multi-factor authentication for an AWS IAM user. An adversary who has obtained access to an AWS tenant may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users. +search: '`cloudtrail` (eventName= DeleteVirtualMFADevice OR eventName=DeactivateMFADevice) + | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id + userAgent eventID awsRegion user_name userIdentity.arn status | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_multi_factor_authentication_disabled_filter`' +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: AWS Administrators may disable MFA but it is highly unlikely for this event to occur without prior notice to the company +references: +- https://attack.mitre.org/techniques/T1621/ +- https://aws.amazon.com/what-is/mfa/ +tags: + analytic_story: + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail.json + impact: 80 + kill_chain_phases: + - Exploitation + message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$ + mitre_attack_id: + - T1621 + nist: + - DE.CM + observable: + - name: aws_account_id + type: Other + role: + - Victim + - name: user_name + type: User + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - src + - eventName + - eventSource + - aws_account_id + - errorCode + - errorMessage + - userAgent + - eventID + - awsRegion + - user_name + - userIdentity.arn + risk_score: 64 + security_domain: threat diff --git a/tests/cloud/aws_multi_factor_authentication_disabled.test.yml b/tests/cloud/aws_multi_factor_authentication_disabled.test.yml new file mode 100644 index 0000000000..b1704828cf --- /dev/null +++ b/tests/cloud/aws_multi_factor_authentication_disabled.test.yml @@ -0,0 +1,13 @@ +name: AWS Multi-Factor Authentication Disabled Unit Test +tests: +- name: AWS Multi-Factor Authentication Disabled + file: cloud/aws_multi_factor_authentication_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From 9c1f8bccc4b1917da83ae969145c4940bacce7fd Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 4 Oct 2022 13:48:48 -0700 Subject: [PATCH 7/8] new SFA detection --- ...uccessful_single_factor_authentication.yml | 65 +++++++++++++++++++ ...sful_single_factor_authentication.test.yml | 15 +++++ 2 files changed, 80 insertions(+) create mode 100644 detections/cloud/aws_successful_single_factor_authentication.yml create mode 100644 tests/cloud/aws_successful_single_factor_authentication.test.yml diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml new file mode 100644 index 0000000000..f63618d4c2 --- /dev/null +++ b/detections/cloud/aws_successful_single_factor_authentication.yml @@ -0,0 +1,65 @@ +name: AWS Successful Single-Factor Authentication +id: a520b1fe-cc9e-4f56-b762-18354594c52f +version: 1 +date: '2022-10-04' +author: Bhavin Patel, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a successful Console Login authentication event against an AWS IAM user for an account without Multi-Factor Authentication enabled. This could be evidence of a misconfiguration, a policy violation or an account take over attempt that should be investigated +search: '`cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No | stats count min(_time) as firstTime max(_time) as lastTime by src eventName eventSource aws_account_id errorCode additionalEventData.MFAUsed userAgent eventID awsRegion user_name userIdentity.arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_successful_single_factor_authentication_filter`' +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS. +references: +- https://attack.mitre.org/techniques/T1621/ +- https://attack.mitre.org/techniques/T1078/004/ +- https://aws.amazon.com/what-is/mfa/ +tags: + analytic_story: + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail.json + impact: 80 + kill_chain_phases: + - Exploitation + message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$ + mitre_attack_id: + - T1078.004 + nist: + - DE.CM + observable: + - name: user_name + type: User + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - src + - eventName + - eventSource + - aws_account_id + - errorCode + - additionalEventData.MFAUsed + - userAgent + - eventID + - awsRegion + - user_name + - userIdentity.arn + risk_score: 64 + security_domain: threat diff --git a/tests/cloud/aws_successful_single_factor_authentication.test.yml b/tests/cloud/aws_successful_single_factor_authentication.test.yml new file mode 100644 index 0000000000..da4ce3931f --- /dev/null +++ b/tests/cloud/aws_successful_single_factor_authentication.test.yml @@ -0,0 +1,15 @@ +name: AWS Successful Single-Factor Authentication Unit Test +tests: +- name: AWS Successful Single-Factor Authentication + file: cloud/aws_successful_single_factor_authentication.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true + + From 4daefa51ac4b5776b9a7dfc82141abf821e568d8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 4 Oct 2022 15:02:43 -0700 Subject: [PATCH 8/8] update datasets --- detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml index 574593d0d1..e05445d491 100644 --- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: [] description: The following analytic identifies multiple failed multi-factor authentication requests to an AWS Console for a single user. AWS Cloudtrail logs provide a a very useful field called `additionalEventData` that logs information regarding usage of MFA. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. AWS Environments can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others. search: '`cloudtrail` eventName= ConsoleLogin "additionalEventData.MFAUsed"=Yes errorMessage="Failed authentication" | bucket span=5m _time -| stats dc(_raw) as mfa_prompts values(userAgent) as userAgent values(src) as src by _time user_name user_arn aws_account_id eventName errorMessage | `aws_multiple_failed_mfa_requests_for_user_filter`' +| stats dc(_raw) as mfa_prompts values(userAgent) as userAgent values(src) as src by _time user_name user_arn aws_account_id eventName errorMessage | where mfa_prompts > 10| `aws_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS Cloudtrail logs. known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. references: