heroui logo

Auth0 Push Notification Fatigue

Panther Rules

View Source
Summary
The rule "Auth0 Push Notification Fatigue" monitors for excessive push notifications sent to a user, which may indicate an attempt at push notification fatigue - a common tactic where attackers overwhelm a user with multiple notifications in order to bypass Multi-Factor Authentication (MFA). This rule is enabled and has a high severity rating due to the potential risk of compromising user accounts. If the threshold of 5 push notifications is exceeded within a 30-minute period, an alert is triggered, prompting an investigation into whether these notifications were initiated due to legitimate user actions or malicious intent.
Categories
  • Identity Management
  • Cloud
  • Application
Data Sources
  • User Account
  • Application Log
  • Cloud Service
ATT&CK Techniques
  • T1621
Created: 2025-10-17