Multifactor Authentication Interrupted

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.