Auth0 Same Phone Number Shared Across Multiple Users as MFA

Description

Detecs when more than one user shares a phone number with another for MFA purposes. Attackers may register their phone number for multiple compromised accounts.

Query · python

from panther_auth0_helpers import auth0_alert_context


def rule(event):
    data_type = event.deep_get("data", "type", default="<NO_TYPE_FOUND>")
    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")
    phone_number = str(
        event.deep_get(
            "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
        )
    )

    return (
        data_type == "gd_enrollment_complete"
        and data_description == "Guardian - Enrollment complete (sms)"
        and bool(phone_number)
    )


def unique(event):
    return event.deep_get("data", "user_id", default="")


def dedup(event):
    return str(
        event.deep_get(
            "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
        )
    )


def title(event):
    user_id = event.deep_get("data", "user_id", default="<NO_USER_ID_FOUND>")
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    phone_number = event.deep_get(
        "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    return (
        f"Auth0 User [{user}] having user_id [{user_id}] "
        f"shares phone number [{phone_number}] as MFA in "
        f"your organization's tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Analyst notes

Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.

Raw source Auth0 Same Phone Number Shared Across Multiple Users as MFA · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: Detecs when more than one user shares a phone number with another for MFA purposes. Attackers may register their phone number for multiple compromised accounts.
DisplayName: "Auth0 Same Phone Number Shared Across Multiple Users as MFA"
Enabled: true
Filename: auth0_same_phone_mfa_multiple_users.py
Runbook: Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.
Reference: https://github.com/auth0/auth0-customer-detections/tree/main/detections/multiple_phone_numbers_are_registered_as_mfa.yml
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
DedupPeriodMinutes: 60
LogTypes:
  - Auth0.Events
RuleID: "Auth0.SamePhone.MultipleUsers.MFA"
Threshold: 2
Tests:
  - ExpectedResult: true
    Log:
      data:
        client_id: 1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr
        client_name: ""
        date: "2025-10-03 14:09:32.149000000"
        description: "Guardian - Enrollment complete (sms)"
        details:
          authenticator:
            phone_number: 1234567891
          request:
            auth:
              credentials:
                jti: 0000000000ecaf1bfbadb06900d22049
              strategy: jwt
              user:
                email: eve@lexcorp.com
                name: Homer Simpson
            channel: https://manage.auth0.com/
            ip: 12.12.12.12
            userAgent: >-
              Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
              (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36
          response:
            body: []
            statusCode: 200
        ip: 12.12.12.12
        log_id: "90020230523204756343781000000000000001223372037583230452"
        type: "gd_enrollment_complete"
        user_agent: >-
          Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML,
          like Gecko) Chrome/1.2.3.4 Safari/537.36
        user_id: google-oauth2|105261262156475850461
      log_id: "90020230523204756343781000000000000001223372037583230452"
      p_any_ip_addresses:
        - 12.12.12.12
      p_any_usernames:
        - google-oauth2|105261262156475850461
      p_event_time: "2023-05-23 20:47:51.149"
      p_log_type: Auth0.Events
      p_parse_time: "2023-05-23 20:49:28.671"
      p_row_id: 00000000004a745ce33b57be383c543e
      p_schema_version: 0
      p_source_id: b9031579-b2c5-45c2-b15c-632b995a4e36
      p_source_label: Org Auth0 Tenant Label
    Name: Shared Phone Number as MFA
  - ExpectedResult: false
    Log:
      data:
        client_id: 1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr
        client_name: ""
        date: "2025-10-03 14:09:32.149000000"
        description: "Guardian - Enrollment complete (voice)"
        details:
          authenticator:
            phone_number: 1234567891
          request:
            auth:
              credentials:
                jti: 0000000000ecaf1bfbadb06900d22049
              strategy: jwt
              user:
                email: eve@lexcorp.com
                name: Homer Simpson
            channel: https://manage.auth0.com/
            ip: 12.12.12.12
          response:
            body: []
            statusCode: 200
        ip: 12.12.12.12
        log_id: "90020230523204756343781000000000000001223372037583230452"
        type: "gd_enrollment_complete"
        user_id: google-oauth2|105261262156475850461
      p_event_time: "2023-05-23 20:47:51.149"
      p_log_type: Auth0.Events
      p_row_id: 00000000004a745ce33b57be383c543e
      p_source_label: Org Auth0 Tenant Label
    Name: Non-SMS Enrollment (Voice) - No Match
  - ExpectedResult: false
    Log:
      data:
        client_id: 1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr
        client_name: ""
        date: "2025-10-03 14:09:32.149000000"
        description: "Guardian - Enrollment complete (sms)"
        details:
          authenticator:
            phone_number: ""
          request:
            auth:
              strategy: jwt
              user:
                email: denethor@lotr.com
            channel: https://manage.auth0.com/
            ip: 10.10.10.10
          response:
            body: []
            statusCode: 200
        ip: 10.10.10.10
        type: "gd_enrollment_complete"
        user_id: google-oauth2|888888888888888888888
      p_event_time: "2023-05-23 20:47:51.149"
      p_log_type: Auth0.Events
      p_row_id: 00000000004a745ce33b57be383c543f
      p_source_label: Org Auth0 Tenant Label
    Name: SMS Enrollment Missing Phone Number - No Match

# ------ paired body: auth0_same_phone_mfa_multiple_users.py ------

from panther_auth0_helpers import auth0_alert_context


def rule(event):
    data_type = event.deep_get("data", "type", default="<NO_TYPE_FOUND>")
    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")
    phone_number = str(
        event.deep_get(
            "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
        )
    )

    return (
        data_type == "gd_enrollment_complete"
        and data_description == "Guardian - Enrollment complete (sms)"
        and bool(phone_number)
    )


def unique(event):
    return event.deep_get("data", "user_id", default="")


def dedup(event):
    return str(
        event.deep_get(
            "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
        )
    )


def title(event):
    user_id = event.deep_get("data", "user_id", default="<NO_USER_ID_FOUND>")
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    phone_number = event.deep_get(
        "data", "details", "authenticator", "phone_number", default="<NO_PHONE_NUMBER_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    return (
        f"Auth0 User [{user}] having user_id [{user_id}] "
        f"shares phone number [{phone_number}] as MFA in "
        f"your organization's tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.