Attempted Bypass of Okta MFA

calendar Sep 25, 2024 · Data Source: Okta Use Case: Identity and Access Audit Tactic: Credential Access  ·
Share on: linkedin copy

Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/05/21"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA
11policies configured for an organization in order to obtain unauthorized access to an application.
12"""
13index = ["filebeat-*", "logs-okta*"]
14language = "kuery"
15license = "Elastic License v2"
16name = "Attempted Bypass of Okta MFA"
17note = """## Triage and analysis
18
19### Investigating Attempted Bypass of Okta MFA
20
21Multi-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.
22
23This rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.
24
25#### Possible investigation steps
26
27- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
28- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
29- Examine the `okta.outcome.reason` field for additional context around the bypass attempt.
30- Check the `okta.outcome.result` field to confirm the MFA bypass attempt.
31- Check if there are multiple unsuccessful MFA attempts from the same actor or IP address (`okta.client.ip`).
32- Check for successful logins immediately following the MFA bypass attempt.
33- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.
34
35### False positive analysis
36
37- Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.
38- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.
39- Verify the actor's MFA settings to ensure they are correctly configured.
40
41### Response and remediation
42
43- If unauthorized access is confirmed, initiate the incident response process.
44- Immediately lock the affected actor account and require a password change.
45- Consider resetting MFA tokens for the actor and require re-enrollment.
46- Check if the compromised account was used to access or alter any sensitive data or systems.
47- If a specific MFA bypass technique was used, ensure your systems are patched or configured to prevent such techniques.
48- Assess the criticality of affected services and servers.
49- Work with your IT team to minimize the impact on users and maintain business continuity.
50- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
51- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
52- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
53
54## Setup
55
56The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
57references = [
58    "https://developer.okta.com/docs/reference/api/system-log/",
59    "https://developer.okta.com/docs/reference/api/event-types/",
60    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
61    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
62    "https://www.elastic.co/security-labs/okta-and-lapsus-what-you-need-to-know",
63    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
64]
65risk_score = 73
66rule_id = "3805c3dc-f82c-4f8d-891e-63c24d3102b0"
67severity = "high"
68tags = ["Data Source: Okta", "Use Case: Identity and Access Audit", "Tactic: Credential Access"]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73event.dataset:okta.system and event.action:user.mfa.attempt_bypass
74'''
75
76
77[[rule.threat]]
78framework = "MITRE ATT&CK"
79[[rule.threat.technique]]
80id = "T1111"
81name = "Multi-Factor Authentication Interception"
82reference = "https://attack.mitre.org/techniques/T1111/"
83
84
85[rule.threat.tactic]
86id = "TA0006"
87name = "Credential Access"
88reference = "https://attack.mitre.org/tactics/TA0006/"

Triage and analysis

Investigating Attempted Bypass of Okta MFA

Multi-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.

This rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.

Possible investigation steps

  • Identify the actor related to the alert by reviewing okta.actor.id, okta.actor.type, okta.actor.alternate_id, or okta.actor.display_name fields in the alert.
  • Review the okta.client.user_agent.raw_user_agent field to understand the device and software used by the actor.
  • Examine the okta.outcome.reason field for additional context around the bypass attempt.
  • Check the okta.outcome.result field to confirm the MFA bypass attempt.
  • Check if there are multiple unsuccessful MFA attempts from the same actor or IP address (okta.client.ip).
  • Check for successful logins immediately following the MFA bypass attempt.
  • Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.

False positive analysis

  • Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.
  • Check the geographical location (okta.request.ip_chain.geographical_context) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.
  • Verify the actor's MFA settings to ensure they are correctly configured.

Response and remediation

  • If unauthorized access is confirmed, initiate the incident response process.
  • Immediately lock the affected actor account and require a password change.
  • Consider resetting MFA tokens for the actor and require re-enrollment.
  • Check if the compromised account was used to access or alter any sensitive data or systems.
  • If a specific MFA bypass technique was used, ensure your systems are patched or configured to prevent such techniques.
  • Assess the criticality of affected services and servers.
  • Work with your IT team to minimize the impact on users and maintain business continuity.
  • If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
  • Implement security best practices outlined by Okta.
  • Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top