mfaStatus

Indicates whether multi-factor authentication (MFA) was used for authentication during the session.

In CloudTrail, you can find this value as userIdentity.sessionContext.attributes.mfaAuthenticated.