Okta Multiple Failed MFA Requests For User
Last updated 2 days ago on 2026-07-17
About
The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Okta tenant. It triggers when more than 10 MFA attempts fail within 5 minutes, using Okta event logs to detect this pattern. This activity is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests, a technique used by threat actors like Lapsus and APT29. If confirmed malicious, this could lead to unauthorized access, potentially compromising sensitive information and systems.
- Platform
Splunk
- Tags
- Data Source: SplunkDomain: ApplicationRule Type: QueryOS: Any
- Severity
- medium
- Risk Score
- 47
- References
- https://attack.mitre.org/techniques/T1621/(external, opens in a new tab or window)
- False Positives
- Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed and monitor for any unusual activity.
- Source
- View on GitHub(external, opens in a new tab or window)
Definition
- Rule Language
- SPL
- Rule Type
- query
text code block:`okta` eventType=user.authentication.auth_via_mfa outcome.result=FAILURE debugContext.debugData.factor!=PASSWORD_AS_FACTOR | bucket _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage) values(src_ip) as src_ip values(debugContext.debugData.factor) values(dest) as dest BY _time src_user | where count >= 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_multiple_failed_mfa_requests_for_user_filter`
View this rule on Splunk
This rule was sourced from the official Splunk public repository. View the original rule on GitHub(external, opens in a new tab or window).