MFA Push Fatigue - detects when a user is repeatedly prompted for MFA push.

title: MFA Push Fatigue - detects when a user is repeatedly prompted for MFA push.
id: e675f02e-716c-11f0-8602-723487b9527c
status: experimental
description: |
    An adversary with access to compromised passwords may try to push bomb the victim.
    There is a chance that the victim will accept an MFA prompt to stop irritation.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: gd_send_pn
        data.description: "Guardian - Second factor notification sent"
    condition: selection
explanation: >
    The query below filters events capturing sending push notifications.
    The Splunk query looks up additinal statistics, i.e. time window, number of pushes per notification.
    The alert is created when selected thresholds have been exceeded.
    It displays the IPs, number of affected users, and time window.
splunk: >
    index=auth0 data.tenant_name="{your_tenant_name}"
    data.type=gd_send_pn
    | fields data.user_id, data.ip
    | stats min(_time) as window_start_time, max(_time) as window_end_time, count as count_pushes_per_user by data.user_id
    ```| stats max(count_pushes_per_user) as max_count```
    | eval window_duration_seconds = window_end_time - window_start_time
    | eval window_duration_mins = window_duration_seconds/60
    | where window_duration_mins<={time_window_threshold} AND count_pushes_per_user > {count_pushes_per_user_threshold}
    ```Display the information in a table```
    | table count_pushes_per_user, window_duration_mins, data.user_id, data.ip
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name, how quick were seen push notifications were sent,
      i.e {time_window_threshold}, and how many push notifications have been sent per user ({count_pushes_per_user_threshold}).
    - A similar detection (with less details) can be implemented through Security Center and its alerts.
tenant_logs: |
    type:"gd_send_pn" AND description: "Guardian - Second factor notification sent"
prevention:
    - Enforcing strong MFA authenticators such as phishing-resistance with FIDO2 WebAuthn.
    - Implement passwordless authentication to reduce the risk for initial password compromise.
falsepositives:
    - Legitimate users who are trying to log in and are repeatedly prompted for MFA due to network issues or other problems.
level: medium
tags:
    - attack.credential-access
    - attack.t1621