Skip to content

Multi-Factor Authentication Interception

Technique · ATTACK:enterprise:T1111

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1111",
  "title": "Multi-Factor Authentication Interception",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1111",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dd43c543-bb85-4a6f-aa6e-160d90d06a49",
  "external_id": "T1111",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:23.195Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "GCN RSA June 2011",
      "url": "https://www.route-fifty.com/cybersecurity/2011/06/rsa-confirms-its-tokens-used-in-lockheed-hack/282818/"
    },
    {
      "source_name": "Mandiant M Trends 2011",
      "url": "https://dl.mandiant.com/EE/assets/PDF_MTrends_2011.pdf"
    },
    {
      "source_name": "Okta Scatter Swine 2022",
      "url": "https://sec.okta.com/scatterswine"
    }
  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1104 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0154e3ae-8ccc-4ebb-a14b-2305d9212651

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b6da092-7380-4bd3-bd4c-f136a5b9b4cc

Alienvault Sykipot DOD Smart Cards

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--381a628b-5401-43d0-853a-c2b0dbce83c3

FoxIT Wocao December 2019

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58996a9f-ab17-4942-9afd-bb336af9a15b

KISA Operation Muzabi

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78b41d13-222f-4ab7-8bcd-af2e0e169a45

Evilginx 2 July 2018

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96213379-cdf0-4ee0-8f0c-a9c0d5ffca7e

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dde3cae1-3541-4a6f-a945-4bf5d3a391c3

CISA Leviathan 2024

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e925337d-e878-48ad-a53c-3a3f4656849e

NCC Group Chimera January 2021

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea2bea46-e1fd-4edf-bba7-8d0552e1975f

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1111

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc5c0e5f-b730-4396-9922-7e2e91b4a106

MSTIC DEV-0537 Mar 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.