Phishing Series 2026: Azure AD MFA Push Fatigue Followed by Eventual Approval
Detects instances where a user account experiences a high volume of failed MFA attempts (MFA push fatigue) within a short window, which is subsequently followed by a successful authentication. This behavior is indicative of an attacker attempting to wear down a user into approving an MFA request for an unauthorized access attempt.
Sigma
