Multifactor Authentication Denied by User
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Sigma
