MFA Fatigue Attack - Push Denial Spam Followed by Successful Sign-in from Different IP
Detects MFA fatigue attacks where a user receives more than 10 MFA push denials within a 10-minute window, followed immediately by a successful authentication from a different IP address. This behavior is indicative of an adversary bombarding a user with push notifications until they are approved, followed by account takeover.
Microsoft Sentinel (KQL)
