Microsoft 365 MFA fatigue
A burst of multi-factor authentication challenges / denials for one account — the shape of MFA fatigue ("push bombing"), where an attacker who already…
What it detects
A burst of multi-factor authentication challenges / denials for one account — the shape of MFA fatigue ("push bombing"), where an attacker who already has the password repeatedly triggers MFA prompts hoping the user eventually approves one. Keys on the Entra sign-in error codes for MFA-required / MFA-denied folded into the message (500121 denied, 50074/50076/50079 MFA required).
MITRE ATT&CK mapping
False positives and triage
A user genuinely failing MFA a few times is normal. The signal is many MFA challenges/denials for one account in a short window, especially followed by a success (an approved prompt) — correlate with the source IP and a preceding password-spray. A following success is a likely compromise.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_mfa_fatigue.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mfa_fatigue
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1621, T1110]
description: |
A burst of multi-factor authentication challenges / denials for one account —
the shape of MFA fatigue ("push bombing"), where an attacker who already has the
password repeatedly triggers MFA prompts hoping the user eventually approves one.
Keys on the Entra sign-in error codes for MFA-required / MFA-denied folded into
the message (500121 denied, 50074/50076/50079 MFA required).
match:
provider: AzureAD
event_category: authentication
event_outcome: failure
raw_message_contains_any:
- "ErrorNumber=500121"
- "ErrorNumber=50074"
- "ErrorNumber=50076"
- "ErrorNumber=50079"
threshold:
count: 5
window_seconds: 600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
A user genuinely failing MFA a few times is normal. The signal is many MFA
challenges/denials for one account in a short window, especially followed by a
success (an approved prompt) — correlate with the source IP and a preceding
password-spray. A following success is a likely compromise.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.