MFA Push Fatigue - Repeated MFA Challenges to Same User
This rule detects potential MFA push fatigue attacks by identifying a high volume of failed multi-factor authentication challenges for a single user within a short time window. It aggregates sign-in logs, specifically looking for result types indicative of MFA failures, and alerts if a user receives more than a defined threshold of MFA challenges within a 30-minute period.
Microsoft Sentinel (KQL)
