MFA Fatigue Attack - Repeated Push Notification Requests
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
Suricata
