Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
67 detections
Filters
Last updated
All Time
Detection languages
41
10
6
4
4
Contributors
39
11
5
3
2
Categories
21
18
17
12
11
Platforms
37
8
7
7
4
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
32
30
27
21
13
CVEs
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects potential Multi-Factor Authentication (MFA) push-bombing, also known as MFA fatigue, where an adversary floods a user with push requests in hopes that the user eventually approves one. The rule flags instances where a successful MFA push approval is preceded by five or more failed, denied, or timed-out MFA push notifications within a 15-minute rolling window for the same user.
Detects MFA push-bombing or authentication fatigue attacks where an adversary repeatedly triggers MFA challenge requests for a user in a short period, potentially from multiple IP addresses, culminating in a successful authentication event. This behavior is indicative of an attacker attempting to coerce a user into approving an MFA request.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects MFA request abuse (T1621) by identifying a user receiving 5 or more MFA push, SMS, or call denials/timeouts within a 10-minute window across Entra ID, Okta, or Duo authentication logs. This behavior is indicative of an MFA fatigue attack, where an adversary continuously triggers MFA prompts until the user eventually approves the request out of frustration or confusion.
Detects the registration of a new MFA device or authenticator by a user shortly after a password reset event, where the registration originates from an IP address classified as a hosting provider, datacenter, or VPN. This pattern is indicative of a help-desk or vishing-based account takeover attack where an adversary registers their own MFA device to gain persistent access.
This rule detects two suspicious patterns related to authentication: (1) 'MFA Fatigue' or 'Push Bombing' where a user experiences a high volume of MFA push denials followed by an acceptance in a short timeframe, and (2) potential account takeover where a help-desk initiated password reset is followed by an MFA re-registration or new device enrollment by the same user within 30 minutes.
Detects a pattern of MFA fatigue or 'push-bombing' where a user receives 5 or more MFA challenge requests within 10 minutes, immediately followed by a successful authentication event. This pattern is characteristic of attackers who have obtained user credentials and are attempting to bypass MFA by repeatedly triggering push notifications until the user grants access.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects a pattern of MFA fatigue or 'push-bombing' where a user receives 5 or more MFA challenge requests within 10 minutes, immediately followed by a successful authentication event. This pattern is characteristic of attackers who have obtained user credentials and are attempting to bypass MFA by repeatedly triggering push notifications until the user grants access.
Detects the registration of a new MFA device or authenticator by a user shortly after a password reset event, where the registration originates from an IP address classified as a hosting provider, datacenter, or VPN. This pattern is indicative of a help-desk or vishing-based account takeover attack where an adversary registers their own MFA device to gain persistent access.
Detects user account lockouts or instances where a user has been flagged for frequent failed authentication attempts within the Duo Security platform. This activity is indicative of brute force attacks, credential stuffing, or attempts to bypass Multi-Factor Authentication (MFA) via fatigue or repeated request generation.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
This rule detects instances where a user has explicitly marked an MFA push notification as fraudulent within the Duo Security platform. This indicates that an unauthorized party may have triggered an MFA request using stolen credentials, and the legitimate user is actively denying the authentication attempt.
Detects instances where a user who has not enrolled in Duo MFA successfully authenticates due to being connected to a defined trusted network. This behavior indicates an MFA coverage gap, potentially allowing an attacker to authenticate as an unenrolled user without MFA if they gain access to a trusted network or VPN.
Duo MFA Push Fatigue Activity
Cortex XDR
Detects a suspicious burst of multi-factor authentication (MFA) push request denials (such as user cancellations or ignored requests) originating from a single user within a short time window. This behavior is indicative of MFA fatigue, where an attacker repeatedly triggers MFA requests in an attempt to annoy or trick the legitimate user into inadvertently approving a push notification.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
Detects MFA fatigue attacks via repeated authentication push requests
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects automated multi-factor authentication (MFA) push bombing attempts targeting Duo Security's API. It specifically looks for HTTP POST requests to 'api.duosecurity.com' and triggers an alert if 10 such requests are observed from the same source IP within a 30-second window. This behavior is indicative of an attacker repeatedly sending MFA push notifications to a user's device in an attempt to overwhelm them or trick them into approving a fraudulent login.
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
Page 1 of 4