Google Workspace - Successful MFA Completion After A Stream Of Login Failures
This alert indicates that a user has successfully passed MFA after a stream of login failures. This activity may indicate that an attacker has successfully brute forced an accounts credentials and has passed MFA.
Microsoft Sentinel (KQL)
