Potential Multi-Factor Authentication (MFA) Interaction

nomit vyas@xoxo

•updated Jun 24, 2026•3•0•10

This rule detects network events where the 'AdditionalFields' contain keywords commonly associated with Multi-Factor Authentication (MFA) such as 'otp', 'verify', '2fa', or 'mfa', and the 'RemoteIP' is a valid IPv4 address. This could indicate attempts to interact with, or potentially bypass, MFA mechanisms.