MFA Fatigue Detection
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
Microsoft Sentinel (KQL)
