Most Important Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: MFA Push-Bombing Burst Followed by Successful Login (T1621)
Detects a pattern of MFA fatigue or 'push-bombing' where a user receives 5 or more MFA challenge requests within 10 minutes, immediately followed by a successful authentication event. This pattern is characteristic of attackers who have obtained user credentials and are attempting to bypass MFA by repeatedly triggering push notifications until the user grants access.
YARA-L
