Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1621

Multi-Factor Authentication Request Generation

Credential Access 24 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Potential Okta MFA Bombing via Push Notifications production 2026-10-06
elastic Potentially Successful Okta MFA Bombing via Push Notifications production 2026-10-06
splunk PingID New MFA Method After Credential Reset production 2026-09-29
elastic Entra ID User Reported Suspicious Activity production 2026-09-18
splunk Okta Multiple Failed MFA Requests For User production 2026-05-13
splunk Okta Successful Single Factor Authentication production 2026-05-13
splunk PingID Mismatch Auth Source and Verification Response production 2026-05-13
splunk PingID Multiple Failed MFA Requests For User production 2026-05-13
splunk PingID New MFA Method Registered For User production 2026-05-13
splunk ASL AWS Multi-Factor Authentication Disabled production 2026-05-13
splunk AWS Console Login Failed During MFA Challenge production 2026-05-13
splunk AWS Multi-Factor Authentication Disabled production 2026-05-13
splunk AWS Multiple Failed MFA Requests For User production 2026-05-13
splunk Azure AD Authentication Failed During MFA Challenge production 2026-05-13
splunk Azure AD Multiple Denied MFA Requests For User production 2026-05-13
splunk Azure AD Multiple Failed MFA Requests For User production 2026-05-13
splunk GCP Authentication Failed During MFA Challenge production 2026-05-13
splunk GCP Multiple Failed MFA Requests For User production 2026-05-13
splunk O365 Multiple Failed MFA Requests For User production 2026-05-13
splunk Okta Authentication Failed During MFA Challenge production 2026-05-13
splunk Okta Mismatch Between Source and Response for Verify Push Request production 2026-05-13
sigma Multifactor Authentication Interrupted test 2022-12-18
sigma Multifactor Authentication Denied test 2022-03-24
sentinel Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121) Scheduled —