MFA Bombing Fatigue Attack - 5+ Denials Followed by Success (T1621)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.