Google Workspace - MFA Fatigue Followed By Successful Login
An attacker knows a users login credentials for an account with MFA enabled. The attacker overloads the user with MFA requests hoping the user will accept one of them. This detection looks for a successful MFA completion that follows a stream of failed MFA requests within the past hour.
Microsoft Sentinel (KQL)
