MITRE D3FENDdefensive technique

D3-MFA Multi-factor Authentication

Official page ↗
Tactic
Harden

Definition

Requiring proof of two or more pieces of evidence in order to authenticate a user.

How it works

How it works When logging into an account users present two or more credentials that fall into different categories: something you know (password or PIN), something you have (smart card or phone), or something you are (fingerprint). Considerations MFA configuration steps may vary across accounts and in some cases left up to users to activate and implement.

Related

Counters · MITRE ATT&CK (25)

  • T0892 Change Credential technique
  • T1606 Forge Web Credentials technique
  • T1606.001 Web Cookies sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1003.003 NTDS sub-technique
  • T1003.008 /etc/passwd and /etc/shadow sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1558 Steal or Forge Kerberos Tickets technique
  • T1558.001 Golden Ticket sub-technique
  • T1552 Unsecured Credentials technique
  • T1550 Use Alternate Authentication Material technique
  • T1550.001 Application Access Token sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1098.001 Additional Cloud Credentials sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1528 Steal Application Access Token technique
  • T1134 Access Token Manipulation technique
  • T1003 OS Credential Dumping technique
  • T1098 Account Manipulation technique
  • T1110 Brute Force technique

Child of · MITRE D3FEND (1)

  • D3-AA Agent Authentication defensive technique

References