Most Important Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Repeated MFA Push Triggered by Self-Service Password Reset (SSPR) Abuse
Detects multiple MFA push notifications generated within a short timeframe for a single user during a Self-Service Password Reset (SSPR) flow. This behavior is indicative of an attacker attempting to perform MFA fatigue/push harassment to gain unauthorized access via SSPR or to bypass account security controls.
YARA-L
