Multifactor Authentication Denied — Detection Rule

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read the full analysis on IntelFusions