AWS Multiple Failed MFA Requests For User

The analytic identifies multiple failed multi-factor authentication (MFA) requests to an AWS Console for a single user within a short timeframe (more than 10 failed MFA prompts within 5 minutes). This activity may indicate an adversary attempting to bypass MFA through 'MFA fatigue' attacks, where repeated authentication requests are sent to the user in hopes they will eventually approve one, leading to unauthorized access to the AWS environment.