Failed MFA Challenge

Informational Investigating

ALR-00407 · 2026-07-08T22:16:09Z

Description

Multiple failed MFA challenges for user 'system' — 12 push notifications in 3 minutes suggesting MFA fatigue attack. Attack Surface Scanner locked account.

Alert Metadata

Alert ID: ALR-00407
Timestamp: 2026-07-08T22:16:09Z
Severity: Informational
Status: Investigating
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: VM-DEV-01
User Account: system
Source IP: 91.21.195.151
Destination IP: 10.1.139.9
Origin Country: IN India

MITRE ATT&CK Mapping

Tactic: Credential Access
Technique: T1621
Reference: attack.mitre.org/techniques/T1621

Investigation Timeline

22:16:09 Event ingested by SOC365 Engine

22:16:10 EmilyAI triage started — correlation enrichment

22:16:24 EmilyAI confidence: 93% — escalated to human analyst

22:16:27 Alert assigned to analyst: EmilyAI (auto)

22:18:43 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00129	4h ago	Lateral Movement Detected	Low	Escalated	VM-DEV-01
ALR-00261	20h ago	Shadow IT Discovery	Medium	Resolved	VM-DEV-01
ALR-00370	1d ago	Unauthorised USB Device	High	Open	VM-DEV-01
ALR-00232	1d ago	Failed MFA Challenge	Informational	False Positive	SRV-APP-01
ALR-00037	1d ago	Ransomware Behaviour Detected	Low	Resolved	VM-DEV-01