Most Important ShinyHunters 2026: MFA Push Fatigue Bombing Followed by Rapid Approval Anomaly
Detects potential MFA push fatigue (bombing) attacks by identifying users who receive an abnormal frequency of MFA push notification denials or interruptions within a short window, followed immediately by a successful authentication on a previously unseen device fingerprint. This pattern is characteristic of attackers attempting to wear down users into approving unauthorized login requests.
Microsoft Sentinel (KQL)
