Fraudulent Okta MFA Re-enrollment Preceded by Burst of Failed MFA Challenges
Detects Okta MFA factor re-enrollment immediately preceded by a burst (>=2) of failed MFA authentication challenges within 15 minutes, indicating attacker-driven MFA takeover following AiTM credential theft.
Microsoft Sentinel (KQL)
