Lapsus$ (DEV-0537) MFA Prompt Bombing and Anomalous Sign-In
Detects MFA fatigue attacks (MFA prompt-bombing) characterized by repeated denied MFA attempts for a single user, or successful MFA logins that occur under high-risk sign-in conditions, which are characteristic of activity associated with Lapsus$ (DEV-0537/Strawberry Tempest).
Sigma
