Multiple SSO MFA attempts were rejected by a user

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires: Okta
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586) Multi-Factor Authentication Request Generation (T1621)
Severity	Informational

Multiple SSO MFA attempts were rejected by a user. This may indicate an MFA request flooding attack.

An attacker is attempting to gain access to an account secured with MFA.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

A user rejected numerous SSO MFA attempts, which may indicate an MFA flooding attack.

An attacker is attempting to gain access to an account secured with MFA.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A user rejected multiple SSO MFA attempts with suspicious characteristics.

An attacker is attempting to gain access to an account secured with MFA.