Successful MFA Fatigue Attack
Details: Detection for MFA fatigue attacks where a high number of MFA push denies in a short period are followed by a successful sign-in attempt. Hypothesis: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users. Recommended Actions: Review sign-in logs for user around time of alert and contact them directly to confirm/verify activity.
Microsoft Sentinel (KQL)
