Secrets of the Second Factor: Threat Hunting with Multi Factor Authentication

Susan Paskey, who writes as base 16, frames the talk for organizations rather than personal accounts and assumes two-factor authentication is already deployed. After a correct password, the second factor is the target of attacks that vendors rarely mention: repeated pushes or code guessing, help desk social engineering, phishing proxies, weak account recovery, and password dumps checked against MFA prompts.

The middle section is a hunting walkthrough. Beyond raw MFA logs, the speaker recommends pairing them with asset and application inventories, known corporate subnets, employee locations and help desk tickets. Each case starts from log fields such as the access device, IP and ASN, application, and factor result. Findings include a brute-force pattern traced to a mistyped desk phone number, a dormant account being hammered, one phone number shared by six help desk users through an extension that auto-accepted pushes, a support technician adding a phone to colleagues' accounts, and a contractor group using an employee's credentials. The speaker also cautions that IP geolocation and user-agent strings can mislead.

The closing advice is to limit self-enrollment, reconsider phone-call factors, change default prompts, and educate users to report suspicious prompts and credential-sharing requests. Contractors should be included in security training. The main message is that MFA needs continuous log review, establishing a normal baseline and investigating what falls outside it.