MFA Fatigue (OKTA)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into approving multi-factor authentication prompts, potentially compromising their own security. The query identifies MFA fatigue attempts in Okta by correlating repeated Okta Verify push requests, denied pushes, and eventual successful MFA authentication within the same session. Ref: https://www.okta.com/blog/identity-security/mfa-fatigue-growing-security-

Attribute Value
Type Analytic Rule
Solution Okta Single Sign-On
ID c2697b81-7fe9-4f57-ba1d-de46c6f91f9c
Severity Medium
Status Available
Kind Scheduled
Tactics CredentialAccess
Techniques T1621
Required Connectors OktaSSO, OktaSSOv2
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
OktaV2_CL ? ?
Okta_CL 🔶

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Okta Single Sign-On