Duo MFA Push Request Flagged as Fraudulent
This rule detects instances where a user has explicitly marked an MFA push notification as fraudulent within the Duo Security platform. This indicates that an unauthorized party may have triggered an MFA request using stolen credentials, and the legitimate user is actively denying the authentication attempt.
Cortex XDR
