ChecklistCONSTRUCTEDUntested

First 15 minutes: a user is getting MFA prompts they did not start

Repeated MFA prompts mean somebody already has the password and is waiting for a tired tap. What to tell the user, what to check, and what to change so the next attempt fails.

high severityCredential AccessT1621T1078.004

The clock starts when

A user reports MFA push notifications or calls they did not start, or logs show repeated MFA challenges for one account, often late at night.

0 of 9 done

minutes 0 to 5

Treat the password as known

Tell the user to deny every prompt they did not start, and to report the next one rather than approve it.The prompts only exist because a sign-in with the right password reached the MFA step.
Find the sign-ins behind the prompts: source address, location, app, and the result of each.In Entra ID a denied or unanswered prompt appears as a failed sign-in, for example error 500121.
Check whether any prompt was approved, and what happened in the session after it.

minutes 5 to 10

Make the password useless

Reset the password. If any prompt was approved, revoke every session and refresh token as well.The prompts stop when the password stops working. An approved prompt means a session exists that the reset may not end.
If a prompt was approved, check for an MFA method or device registered in the minutes after it.Registering their own authenticator is the usual next move, and it survives the reset.
Block the source addresses at the identity provider while you scope, knowing they will change.

minutes 10 to 15

Find out who else, and how

Search for the same source addresses against every other account.
Check the user's recent phishing reports and whether the password is reused on other services.Knowing where the password came from decides whether other accounts are exposed the same way.
Record whether number matching or phishing-resistant MFA is enforced for this user. If not, raise it.Number matching defeats blind approval. Phishing-resistant MFA also defeats a relayed login.

Do not

Do not tell the user to approve the next prompt to see what happens.
Do not close it because every prompt was denied. The password is still compromised until it is changed.
Do not assume the attacker is abroad because the address is. Plenty of these come from residential proxies.

Escalate now if

Any prompt was approved.
The account is privileged, or belongs to finance or an executive.
Several accounts are receiving prompts at the same time.

Minute sixteen. The checklist ends here and the response does not.

Open the cloud account compromise playbook

Why this order

The instinct is to treat this as an MFA problem, because that is where it shows. It is a password problem. MFA did its job by asking, and the only reason it is being asked, again and again, is that somebody typed the right password. So the first real fix is changing it, and the questions that matter are whether a prompt was ever approved, and where the password came from.

What this does not cover

A session that was established by an approved prompt and has already been used. If any prompt was approved, you are in an account compromise, not a near miss, and the playbook linked above is where to go next.

sources

Tags: first-15 · mfa · mfa-fatigue · identity · entra-id · okta · T1621