Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1111_multi-factor-authentication-interception
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and netw...
Passed 18 of 22 test cases with the skill, and 15 of 22 without it.
3 fixed15 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are conducting a security review of our hardware token and out-of-band MFA deployment across Linux, Windows, and macOS endpoints. Please provide a security evaluation report that outlines how to assess our attack surface for multi-factor authentication interception, what platform-specific checks to run, a risk rating table for identified findings, and targeted remediation recommendations.
| Checked | Without skill | With skill |
|---|---|---|
| The report includes user training M1017 recommending users remove smart cards when not in use. | Missed | Passed |
| The report assigns a High severity rating to applicable multi-factor authentication interception findings. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.
Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).
Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.
Platforms: Linux, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Multi-Factor Authentication Interception by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1111 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.