MFA fatigue triage queue

Steps

1. 01Mark each of the five users as benign or escalate.

   Do this in the workbench above. This step completes itself when the condition is met.

   HintUnlock solution

2. 02At what time did ben approve a push from the new address?

   Check
   HintUnlock solution

3. 03chen denied every prompt. Why escalate anyway?

   Each prompt means someone already has chen’s correct password, so it must be resetDenied prompts lock the account permanentlyIt does not need escalation because nothing was approved
   HintUnlock solution

4. 04What is the first response for ben?

   Revoke ben’s sessions and refresh tokens, reset the password, review MFA methods for anything newly added, then check mailbox rules and sign-ins since 02:39Send ben an email asking whether the approval was intentionalBlock 203.0.113.77 and close the alert
   HintUnlock solution

5. 05Which control stops this attack pattern from working at all?

   Number matching or phishing-resistant MFA such as passkeys, so a push cannot be approved without the sign-in screen in front of youSending more push notifications so users noticeShorter session lifetimes
   HintUnlock solution