MFA Push Bombing: Multiple MFA Denials Followed by Success

Ali AlEnezi@site

•updated Sep 15, 2026•1•0•1

This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.