Entra Sign-in MFA Satisfied via External Provider with Forged HWK Claim
Detects sign-in events where an external authentication provider is used to fulfill a multi-factor authentication requirement while simultaneously asserting a 'hardware-key' (hwk) claim. This behavior is indicative of an adversary abusing a rogue or misconfigured external MFA provider to forge authentication claims and bypass security controls.
Sigma
