Potential MFA Bypass Using Legacy Client Authentication

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.