Failed MFA Challenge

Informational Escalated

ALR-00002 · 2026-07-04T18:44:24Z

Description

Multiple failed MFA challenges for user 'c.williams' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Cloud Connector locked account.

Alert Metadata

Alert ID: ALR-00002
Timestamp: 2026-07-04T18:44:24Z
Severity: Informational
Status: Escalated
Detection Source: Cloud Connector
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-BACKUP-01
User Account: c.williams
Source IP: 185.191.220.254
Destination IP: 10.2.128.139
Origin Country: KP North Korea

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

18:44:24 Event ingested by SOC365 Engine

18:44:26 EmilyAI triage started — correlation enrichment

18:44:29 EmilyAI confidence: 88% — escalated to human analyst

18:44:47 Alert assigned to analyst: EmilyAI (auto)

18:45:19 Investigation started — querying SIEM and threat intelligence

18:51:05 Containment action taken — endpoint isolated

18:59:56 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00059	24m ago	Kerberoasting Attempt	Informational	Investigating	SRV-BACKUP-01
ALR-00030	8h ago	Failed MFA Challenge	Medium	Resolved	SRV-FILE-01
ALR-00472	9h ago	Ransomware Behaviour Detected	High	Investigating	SRV-BACKUP-01
ALR-00398	11h ago	Failed MFA Challenge	Low	False Positive	SRV-DC-01
ALR-00170	12h ago	Failed MFA Challenge	Informational	Resolved	FW-EDGE-01