MFA Fatigue / Push Bombing Detection
Detects multiple denied or failed multi-factor authentication (MFA) prompts for a single user within a short time window. This pattern is commonly associated with MFA fatigue or push bombing attacks, where an attacker attempts to trick the user into approving an MFA request by spamming prompts repeatedly. This detection uses Azure AD sign-in logs and does not require asset inventory or conditional access policies to be effective.
Microsoft Sentinel (KQL)
