MFA factor enrollment after repeated auth failures, excluding verified helpdesk resets
Detects Okta accounts that enroll a new MFA factor within a short window after multiple failed or abandoned MFA authentication attempts. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistent access by bypassing or reconfiguring MFA. The rule includes logic to exclude legitimate self-service enrollments that have a corresponding verified helpdesk or change-management ticket.
Microsoft Sentinel (KQL)
