Multifactor Authentication Interrupted

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.