MFA Fatigue Attack Detection
Detects potential Multi-Factor Authentication (MFA) fatigue attacks by identifying a high number of MFA denial events for a single user within a short timeframe. This rule specifically looks for sign-in logs where the user explicitly declined the authentication prompt, indicating a possible attempt by an attacker to bombard the user with MFA requests until they approve one.
Microsoft Sentinel (KQL)
