Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials

calendar Dec 9, 2024 · Domain: SaaS Data Source: Okta Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Defense Evasion  ·
Share on: linkedin copy

Identifies a failed OAuth 2.0 token grant attempt for a public client app using client credentials. This event is generated when a public client app attempts to exchange a client credentials grant for an OAuth 2.0 access token, but the request is denied due to the lack of required scopes. This could indicate compromised client credentials in which an adversary is attempting to obtain an access token for unauthorized scopes. This is a New Terms rule where the okta.actor.display_name field value has not been seen in the last 14 days regarding this event.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2024/09/11"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/12/09"
 6min_stack_version = "8.15.0"
 7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies a failed OAuth 2.0 token grant attempt for a public client app using client credentials. This event is
13generated when a public client app attempts to exchange a client credentials grant for an OAuth 2.0 access token, but
14the request is denied due to the lack of required scopes. This could indicate compromised client credentials in which an
15adversary is attempting to obtain an access token for unauthorized scopes. This is a [New
16Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule where the
17`okta.actor.display_name` field value has not been seen in the last 14 days regarding this event.
18"""
19from = "now-9m"
20index = ["filebeat-*", "logs-okta*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials"
24references = [
25    "https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/",
26    "https://developer.okta.com/docs/reference/api/event-types/",
27    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
28    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
29]
30risk_score = 47
31rule_id = "6649e656-6f85-11ef-8876-f661ea17fbcc"
32severity = "medium"
33tags = [
34    "Domain: SaaS",
35    "Data Source: Okta",
36    "Use Case: Threat Detection",
37    "Use Case: Identity and Access Audit",
38    "Tactic: Defense Evasion",
39]
40timestamp_override = "event.ingested"
41type = "new_terms"
42
43query = '''
44event.dataset: okta.system
45    and event.action: "app.oauth2.as.token.grant"
46    and okta.actor.type: "PublicClientApp"
47    and okta.debug_context.debug_data.flattened.grantType: "client_credentials"
48    and okta.outcome.result: "FAILURE"
49    and not okta.client.user_agent.raw_user_agent: "Okta-Integrations"
50    and not okta.actor.display_name: (Okta* or Datadog)
51    and not okta.debug_context.debug_data.flattened.requestedScopes: ("okta.logs.read" or "okta.eventHooks.read" or "okta.inlineHooks.read")
52    and okta.outcome.reason: "no_matching_scope"
53'''
54
55
56[[rule.threat]]
57framework = "MITRE ATT&CK"
58[[rule.threat.technique]]
59id = "T1550"
60name = "Use Alternate Authentication Material"
61reference = "https://attack.mitre.org/techniques/T1550/"
62[[rule.threat.technique.subtechnique]]
63id = "T1550.001"
64name = "Application Access Token"
65reference = "https://attack.mitre.org/techniques/T1550/001/"
66
67
68
69[rule.threat.tactic]
70id = "TA0005"
71name = "Defense Evasion"
72reference = "https://attack.mitre.org/tactics/TA0005/"
73
74[rule.new_terms]
75field = "new_terms_fields"
76value = ["okta.actor.display_name"]
77[[rule.new_terms.history_window_start]]
78field = "history_window_start"
79value = "now-14d"

References

Related rules

to-top