Okta Multiple Failed MFA Requests For User

Status: production
Severity: low
Group by: _time, user
Author: Mauricio Velazco, Splunk
Source: github.com/splunk/security_content

The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this pattern. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests, a technique used by threat actors like Lapsus and APT29. If confirmed malicious, this could lead to unauthorized access, potentially compromising sensitive information and systems.

Known false positives

Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed and monitor for any unusual activity.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1621` Multi-Factor Authentication Request Generation

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule body

name: Okta Multiple Failed MFA Requests For User
id: 826dbaae-a1e6-4c8c-b384-d16898956e73
version: 12
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this pattern. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests, a technique used by threat actors like Lapsus and APT29. If confirmed malicious, this could lead to unauthorized access, potentially compromising sensitive information and systems.
data_source:
    - Okta
search: |-
    `okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR
      | bucket _time span=5m
      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) as src_ip values(debugContext.debugData.factor) values(dest) as dest
        BY _time src_user
      | where count >= 10
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_multiple_failed_mfa_requests_for_user_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed and monitor for any unusual activity.
references:
    - https://attack.mitre.org/techniques/T1621/
intermediate_findings:
    entities:
        - field: src_user
          type: user
          score: 20
          message: Multiple failed MFA requests for user $src_user$ from IP Address - $src_ip$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

Stages and Predicates

Stage 1: `search`

`okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR

Stage 2: `bucket`

| bucket _time span=5m

Stage 3: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) as src_ip values(debugContext.debugData.factor) values(dest) as dest
    BY _time src_user

Stage 4: `where`

| where count >= 10

Stage 5: `search`

| `security_content_ctime(firstTime)`

Stage 6: `search`

| `security_content_ctime(lastTime)`

Stage 7: `search`

| `okta_multiple_failed_mfa_requests_for_user_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`count`	ge	`10`	`field:"count" kind:ge value:"10"`
`debugContext.debugData.factor`	ne	`PASSWORD_AS_FACTOR`	`field:"debugContext.debugData.factor" kind:ne value:"PASSWORD_AS_FACTOR"`
`eventType`	eq	`user.authentication.auth_via_mfa`	`field:"eventType" kind:eq value:"user.authentication.auth_via_mfa"`
`outcome.result`	eq	`FAILURE`	`field:"outcome.result" kind:eq value:"FAILURE"`
`sourcetype`	eq	`OktaIM2:log`	`field:"sourcetype" kind:eq value:"OktaIM2:log"`

Okta Multiple Failed MFA Requests For User

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: search

Stage 2: bucket

Stage 3: stats

Stage 4: where

Stage 5: search

Stage 6: search

Stage 7: search