Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2023/11/10"
3integration = ["okta"]
4maturity = "production"
5updated_date = "2024/12/09"
6min_stack_version = "8.15.0"
7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a
13proxy.
14"""
15false_positives = [
16 "An Okta admnistrator may be logged into multiple accounts from the same host for legitimate reasons.",
17 "Users may share an endpoint related to work or personal use in which separate Okta accounts are used.",
18 "Shared systems such as Kiosks and conference room computers may be used by multiple users.",
19]
20from = "now-9m"
21index = ["filebeat-*", "logs-okta*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy"
25note = """## Triage and analysis
26
27### Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
28
29This rule detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. This may indicate that a shared device between users, or that a user is using a proxy to access multiple accounts for password spraying.
30
31#### Possible investigation steps:
32- Identify the users involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
33- Determine the device client used for these actions by analyzing `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
34 - Since the device is behind a proxy, the `okta.client.ip` field will not be useful for determining the actual device IP address.
35- Review the `okta.request.ip_chain` field for more information about the geographic location of the proxy.
36- With Okta end users identified, review the `okta.debug_context.debug_data.dt_hash` field.
37 - Historical analysis should indicate if this device token hash is commonly associated with the user.
38- Review the `okta.event_type` field to determine the type of authentication event that occurred.
39 - If the event type is `user.authentication.sso`, the user may have legitimately started a session via a proxy for security or privacy reasons.
40 - If the event type is `user.authentication.password`, the user may be using a proxy to access multiple accounts for password spraying.
41- Examine the `okta.outcome.result` field to determine if the authentication was successful.
42- Review the past activities of the actor(s) involved in this action by checking their previous actions.
43- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
44 - This may help determine the authentication and authorization actions that occurred between the user, Okta and application.
45
46### False positive analysis:
47- A user may have legitimately started a session via a proxy for security or privacy reasons.
48- Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
49 - Architecturally, this shared endpoint may leverage a proxy for security or privacy reasons.
50 - Shared systems such as Kiosks and conference room computers may be used by multiple users.
51 - Shared working spaces may have a single endpoint that is used by multiple users.
52
53### Response and remediation:
54- Review the profile of the users involved in this action to determine if proxy usage may be expected.
55- If the user is legitimate and the authentication behavior is not suspicious based on device analysis, no action is required.
56- If the user is legitimate but the authentication behavior is suspicious, consider resetting passwords for the users involves and enabling multi-factor authentication (MFA).
57 - If MFA is already enabled, consider resetting MFA for the users.
58- If any of the users are not legitimate, consider deactivating the user's account.
59- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
60- Check with internal IT teams to determine if the accounts involved recently had MFA reset at the request of the user.
61 - If so, confirm with the user this was a legitimate request.
62 - If so and this was not a legitimate request, consider deactivating the user's account temporarily.
63 - Reset passwords and reset MFA for the user.
64- If this is a false positive, consider adding the `okta.debug_context.debug_data.dt_hash` field to the `exceptions` list in the rule.
65 - This will prevent future occurrences of this event for this device from triggering the rule.
66"""
67references = [
68 "https://developer.okta.com/docs/reference/api/system-log/",
69 "https://developer.okta.com/docs/reference/api/event-types/",
70 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
71 "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
72 "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
73 "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
74]
75risk_score = 47
76rule_id = "50887ba8-7ff7-11ee-a038-f661ea17fbcd"
77setup = "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."
78severity = "medium"
79tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Credential Access"]
80timestamp_override = "event.ingested"
81type = "threshold"
82
83query = '''
84event.dataset:okta.system
85 and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:*
86 and okta.event_type:user.authentication* and okta.security_context.is_proxy:true
87'''
88
89
90[[rule.threat]]
91framework = "MITRE ATT&CK"
92[[rule.threat.technique]]
93id = "T1110"
94name = "Brute Force"
95reference = "https://attack.mitre.org/techniques/T1110/"
96[[rule.threat.technique.subtechnique]]
97id = "T1110.003"
98name = "Password Spraying"
99reference = "https://attack.mitre.org/techniques/T1110/003/"
100
101
102[[rule.threat.technique]]
103id = "T1110"
104name = "Brute Force"
105reference = "https://attack.mitre.org/techniques/T1110/"
106[[rule.threat.technique.subtechnique]]
107id = "T1110.004"
108name = "Credential Stuffing"
109reference = "https://attack.mitre.org/techniques/T1110/004/"
110
111
112
113[rule.threat.tactic]
114id = "TA0006"
115name = "Credential Access"
116reference = "https://attack.mitre.org/tactics/TA0006/"
117
118[rule.threshold]
119field = ["okta.debug_context.debug_data.dt_hash"]
120value = 1
121[[rule.threshold.cardinality]]
122field = "okta.actor.id"
123value = 3
Triage and analysis
Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
This rule detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. This may indicate that a shared device between users, or that a user is using a proxy to access multiple accounts for password spraying.
Possible investigation steps:
- Identify the users involved in this action by examining the
okta.actor.id
,okta.actor.type
,okta.actor.alternate_id
, andokta.actor.display_name
fields. - Determine the device client used for these actions by analyzing
okta.client.ip
,okta.client.user_agent.raw_user_agent
,okta.client.zone
,okta.client.device
, andokta.client.id
fields.- Since the device is behind a proxy, the
okta.client.ip
field will not be useful for determining the actual device IP address.
- Since the device is behind a proxy, the
- Review the
okta.request.ip_chain
field for more information about the geographic location of the proxy. - With Okta end users identified, review the
okta.debug_context.debug_data.dt_hash
field.- Historical analysis should indicate if this device token hash is commonly associated with the user.
- Review the
okta.event_type
field to determine the type of authentication event that occurred.- If the event type is
user.authentication.sso
, the user may have legitimately started a session via a proxy for security or privacy reasons. - If the event type is
user.authentication.password
, the user may be using a proxy to access multiple accounts for password spraying.
- If the event type is
- Examine the
okta.outcome.result
field to determine if the authentication was successful. - Review the past activities of the actor(s) involved in this action by checking their previous actions.
- Evaluate the actions that happened just before and after this event in the
okta.event_type
field to help understand the full context of the activity.- This may help determine the authentication and authorization actions that occurred between the user, Okta and application.
False positive analysis:
- A user may have legitimately started a session via a proxy for security or privacy reasons.
- Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
- Architecturally, this shared endpoint may leverage a proxy for security or privacy reasons.
- Shared systems such as Kiosks and conference room computers may be used by multiple users.
- Shared working spaces may have a single endpoint that is used by multiple users.
Response and remediation:
- Review the profile of the users involved in this action to determine if proxy usage may be expected.
- If the user is legitimate and the authentication behavior is not suspicious based on device analysis, no action is required.
- If the user is legitimate but the authentication behavior is suspicious, consider resetting passwords for the users involves and enabling multi-factor authentication (MFA).
- If MFA is already enabled, consider resetting MFA for the users.
- If any of the users are not legitimate, consider deactivating the user's account.
- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
- Check with internal IT teams to determine if the accounts involved recently had MFA reset at the request of the user.
- If so, confirm with the user this was a legitimate request.
- If so and this was not a legitimate request, consider deactivating the user's account temporarily.
- Reset passwords and reset MFA for the user.
- If this is a false positive, consider adding the
okta.debug_context.debug_data.dt_hash
field to theexceptions
list in the rule.- This will prevent future occurrences of this event for this device from triggering the rule.
References
Related rules
- Attempted Bypass of Okta MFA
- Attempts to Brute Force an Okta User Account
- High Number of Okta Device Token Cookies Generated for Authentication
- Multiple Device Token Hashes for Single Okta Session
- Multiple Okta User Authentication Events with Client Address