Attempt to Modify an Okta Network Zone

  1[metadata]
  2creation_date = "2020/05/21"
  3integration = ["okta"]
  4maturity = "production"
  5updated_date = "2024/09/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a
 11network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network
 12zone in order to remove or weaken an organization's security controls.
 13"""
 14false_positives = [
 15    """
 16    Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are
 17    regularly modified.
 18    """,
 19]
 20index = ["filebeat-*", "logs-okta*"]
 21language = "kuery"
 22license = "Elastic License v2"
 23name = "Attempt to Modify an Okta Network Zone"
 24note = """## Triage and analysis
 25
 26### Investigating Attempt to Modify an Okta Network Zone
 27
 28The modification of an Okta network zone is a critical event as it could potentially allow an adversary to gain unrestricted access to your network. This rule detects attempts to modify, delete, or deactivate an Okta network zone, which may suggest an attempt to remove or weaken an organization's security controls.
 29
 30#### Possible investigation steps:
 31
 32- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.
 33- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.
 34- Examine the `okta.outcome.reason` field for additional context around the modification attempt.
 35- Check the `okta.outcome.result` field to confirm the network zone modification attempt.
 36- Check if there are multiple network zone modification attempts from the same actor or IP address (`okta.client.ip`).
 37- Check for successful logins immediately following the modification attempt.
 38- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.
 39
 40### False positive analysis:
 41
 42- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.
 43- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.
 44- Verify the actor's administrative rights to ensure they are correctly configured.
 45
 46### Response and remediation:
 47
 48- If unauthorized modification is confirmed, initiate the incident response process.
 49- Immediately lock the affected actor account and require a password change.
 50- Consider resetting MFA tokens for the actor and require re-enrollment.
 51- Check if the compromised account was used to access or alter any sensitive data or systems.
 52- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.
 53- Assess the criticality of affected services and servers.
 54- Work with your IT team to minimize the impact on users and maintain business continuity.
 55- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.
 56- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.
 57- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 58
 59## Setup
 60
 61The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 62references = [
 63    "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm",
 64    "https://developer.okta.com/docs/reference/api/system-log/",
 65    "https://developer.okta.com/docs/reference/api/event-types/",
 66    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
 67    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
 68    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
 69]
 70risk_score = 47
 71rule_id = "e48236ca-b67a-4b4e-840c-fdc7782bc0c3"
 72severity = "medium"
 73tags = [
 74    "Use Case: Identity and Access Audit",
 75    "Data Source: Okta",
 76    "Use Case: Network Security Monitoring",
 77    "Tactic: Defense Evasion",
 78]
 79timestamp_override = "event.ingested"
 80type = "query"
 81
 82query = '''
 83event.dataset:okta.system and event.action:(zone.update or network_zone.rule.disabled or zone.remove_blacklist)
 84'''
 85
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89[[rule.threat.technique]]
 90id = "T1562"
 91name = "Impair Defenses"
 92reference = "https://attack.mitre.org/techniques/T1562/"
 93[[rule.threat.technique.subtechnique]]
 94id = "T1562.007"
 95name = "Disable or Modify Cloud Firewall"
 96reference = "https://attack.mitre.org/techniques/T1562/007/"
 97
 98
 99
100[rule.threat.tactic]
101id = "TA0005"
102name = "Defense Evasion"
103reference = "https://attack.mitre.org/tactics/TA0005/"