MFA attack - bombarding a user with SMS for MFA

title: MFA attack - bombarding a user with SMS for MFA
id: 74a1ddea-7172-11f0-ace0-723487b9527c
status: experimental
description: |
    A threat actor can try to bombard a user with SMS messages for MFA in order to deplete the customer's SMS quota leading to Denial of Service.
author: Okta
date: 2025-07-11
modified: 2025-08-04
logsource:
    product: auth0
detection:
    selection:
        data.type: gd_send_sms
        data.description: "Guardian - Second factor sms sent"
    condition: selection
explanation: >
    The query collects events issued when a sms is sent.
    The Splunk detection is based on the number of SMS sent to a single user in a given chunk of time (1h by default).
    If a number of SMS sent to a user exceeds a threshold, it is likely that the user is bombarded with SMS messages.
    The threshold should be adjusted based on the customer's environment and the expected number of SMS messages sent to a user.
    The query prints the affected users.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type = gd_send_sms data.description="Guardian - Second factor sms sent"
    | fields data.user_id
    ```The period of observations - adjust```
    | bin _time span=1h
    | stats count as sms_per_user by data.user_id
    | where sms_per_user > {threshold_for_max_sms}
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant_name, threshold,
      e.g. 10, and the span of the considered time period, e.g. set to 1 hour by default.
tenant_logs: |
    type: "gd_send_sms" AND description: "Guardian - Second factor sms sent"
prevention:
    - Limit the number of SMS messages sent to a user in a given period of time.
    - Consider using alternative MFA methods, such as push notifications or authenticator apps, to reduce the reliance on SMS for MFA.
    - Deploy a send-phone-message action implementing a throttling logic to prevent excessive sms notifications, e.g. exceeding 10 SMS sent per hour.
falsepositives:
    - Legitimate users requesting multiple SMS messages in a short period of time, e.g. due to lost or delayed messages.
level: medium
tags:
    - attack.impact
    - attack.t1499.002