Skip to content
HRM Framework 2.0 , home
Start the assessment

SQ-ATO-03Level 3 · Sequence3 steps in 24 hours

MFA fatigue

Malicious login attempts trigger repeated MFA prompts, the person approves one at an odd hour, and a new factor is registered on the account, all within 24 hours.

View in explorer Suggest a change

Classification

Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
Dimensions Every signal answers one of 3 questions.
Evidence level
Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
ATT&CK tactics
  • Credential Access
  • Persistence
NIST CSF 2.0 (from its signals)
  • DE.CM-03
  • PR.AA-03
MITRE ATT&CK (from its signals)
  • T1110.004
  • T1621

The sequence, step by step

SQ-ATO-033 stepsPeak: Stage 4 Suspected

  1. Step 01ATT&CK tactic: Credential Access

    Repeated MFA prompts

    IA-T-04Targeted by malicious login attempts

    Stage 1Exposed

  2. Step 02ATT&CK tactic: Credential Access

    Odd-hour approval

    IA-B-05Approves MFA after repeated prompts

    Stage 3Exploited

  3. Step 03ATT&CK tactic: Persistence

    New factor registered

    IA-B-05Approves MFA after repeated prompts

    Stage 4Suspected

  4. Breach scenarioHB-02

    Credential abuse & account takeover

    Inside 24 hours

MFA fatigue, 3 steps inside 24 hours: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts, Credential Access, Stage 1 Exposed); then Odd-hour approval (IA-B-05 Approves MFA after repeated prompts, Credential Access, Stage 3 Exploited); then New factor registered (IA-B-05 Approves MFA after repeated prompts, Persistence, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.

A completed sequence is evidence that its steps happened in order inside 24 hours: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.

The definition, in detail

Definition

The prompts place the person at Stage 1, the approval moves them to Stage 3, and the new factor completes the sequence at Stage 4.

Example

A nurse manager's phone buzzed with push prompts through the night; she approved one at 02:40 to make it stop, and an authenticator app was added to the account before dawn.

The steps

3 steps, in order.

  1. Repeated MFA prompts

    IA-T-04 Targeted by malicious login attempts

    ATT&CK tactic: Credential Access · Stage 1 Exposed

  2. Odd-hour approval

    IA-B-05 Approves MFA after repeated prompts

    ATT&CK tactic: Credential Access · Stage 3 Exploited

  3. New factor registered

    IA-B-05 Approves MFA after repeated prompts

    ATT&CK tactic: Persistence · Stage 4 Suspected

How it is measured

Steps
3
Window
24 hours
Sources
Identity provider & MFA

How it is used

Programs watch the 3 steps in order inside 24 hours; a completed run moves the person to Stage 4 Suspected and points at Credential abuse & account takeover.

A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.

Continue exploring

Cite this term

"MFA fatigue" (SQ-ATO-03), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-ato-03-mfa-fatigue

Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.

Same breach scenario

3 other sequences end in Credential abuse & account takeover.

HB-02 Credential abuse & account takeover: every sequence, cohort and signal that points to it.

  • SQ-ATO-015 steps · 72 hours

    Phish to takeover

    1. Step 1: Real phish delivered (SE-T-02 Real phishing delivered to inbox)
    2. Step 2: Link clicked (SE-B-04 Clicks links in real phishing)
    3. Step 3: Unusual login (IA-B-04 Signs in from unusual contexts)
    4. Step 4: New MFA device (IA-B-05 Approves MFA after repeated prompts)
    5. Step 5: Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail)
    6. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-023 steps · 30 days

    Leak to login

    1. Step 1: Credential leaked (IA-T-01 Credentials leaked in a public breach)
    2. Step 2: Failed-login spike (IA-T-04 Targeted by malicious login attempts)
    3. Step 3: Unusual successful login (IA-B-04 Signs in from unusual contexts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

  • SQ-ATO-044 steps · 24 hours

    Help-desk takeover

    1. Step 1: Voice pretext (SE-T-04 Receives callback or voice phishing)
    2. Step 2: MFA reset ticket (SE-A-03 Can reset passwords or MFA for others)
    3. Step 3: New device (IA-B-05 Approves MFA after repeated prompts)
    4. Step 4: Admin login (IA-A-01 Holds admin or privileged roles)
    5. Breach scenario: HB-02 Credential abuse & account takeover

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment