Overview
MFA (multi-factor authentication) events provide important signals about account-access legitimacy. This lesson covers analyzing them.
Learning objectives
- Explain MFA and its event signals.
- Describe MFA-related attack patterns.
- Connect MFA events to compromise detection.
Core concept
Multi-factor authentication (MFA) requires a second factor beyond a password, and MFA events in logs reveal important access signals. Suspicious patterns include: MFA failures/denials (an attacker has the password but not the second factor — a strong sign of an attempted compromise), MFA fatigue/push bombing (an attacker who has the password repeatedly triggers push prompts hoping the user eventually approves one), unexpected MFA prompts the user didn't initiate (someone else is trying their password), and changes to MFA enrollment (an attacker adding their own factor to maintain access). MFA is a powerful defense (it blocks most password-only attacks), and MFA events are correspondingly valuable indicators — both of blocked attacks and of attempts to defeat MFA.
How it works
Analysts examine MFA events alongside login logs. A password success but MFA denial/failure indicates the correct password was used but the second factor wasn't satisfied — often an attacker with stolen credentials stopped by MFA (a blocked compromise attempt worth investigating, since the password is known to the attacker). Repeated MFA push prompts in a short time signal MFA fatigue / push bombing — the attacker spamming approval requests hoping for an accidental or fatigued approval; a user approving after many prompts may indicate a successful bypass. Unexpected prompts a user reports (but didn't initiate) reveal an attacker actively trying their password. MFA enrollment changes (a new factor added) can indicate an attacker establishing persistent access and should be scrutinized. These events connect to account-compromise detection: MFA denials often reveal that credentials are compromised (even if access was blocked), warranting a password reset and investigation. MFA is highly effective, but analysts must watch for the techniques (fatigue, enrollment abuse, and social engineering of the second factor) attackers use against it.
Practical example
The SOC sees MFA events for an account: a correct password followed by repeated MFA push prompts in quick succession — the pattern of MFA fatigue / push bombing. The user hadn't initiated any login, meaning an attacker has the password and is spamming approvals hoping the user taps "approve." Even though MFA held (no approval given), this reveals the password is compromised, so the SOC forces a reset and investigates. Had the user approved a prompt out of confusion, it would signal a successful bypass requiring full account-compromise response. The MFA events exposed both an attempted bypass technique and the underlying credential compromise.
Cybersecurity relevance
MFA is a powerful defense that blocks most password-only attacks, and MFA events are valuable authentication indicators: denials/failures after a correct password often reveal compromised credentials (even when access is blocked — warranting a reset), while push bombing/MFA fatigue, unexpected user-reported prompts, and enrollment changes reveal active attempts to defeat or abuse MFA. Analyzing them connects to account-compromise detection and to defending MFA itself against known bypass techniques (fatigue, enrollment abuse, social engineering). MFA events complete the account-compromise picture alongside failed logins, impossible travel, and unusual devices — making MFA monitoring a key part of the SOC's authentication-anomaly work.
Common mistakes
- Ignoring MFA denials after a correct password (they reveal compromised credentials even when access was blocked).
- Not recognizing push bombing / MFA fatigue as an attack pattern.
- Overlooking MFA enrollment changes as a persistence/compromise indicator.
Key takeaways
- MFA requires a second factor; MFA events reveal signals: denials/failures after a correct password (compromised credentials, attack blocked), push bombing/MFA fatigue, unexpected prompts, and enrollment changes.
- MFA denials often mean the password is compromised even if access was blocked — warranting a reset; push bombing and enrollment abuse are techniques to defeat/abuse MFA.
- MFA is highly effective but must be watched for bypass techniques; MFA events complete the account-compromise picture with failed logins, impossible travel, and unusual devices.
Check your understanding
- What does an MFA denial after a correct password indicate, and why act on it even if access was blocked?
- What is MFA fatigue / push bombing, and why are MFA enrollment changes worth scrutinizing?