Multiple Okta Client Addresses for a Single User Session
Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2023/11/08"
3integration = ["okta"]
4maturity = "production"
5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
6min_stack_version = "8.10.0"
7updated_date = "2023/11/08"
8
9
10[rule]
11author = ["Elastic"]
12description = """
13Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user's Okta account and is using it to access the organization's resources.
14"""
15from = "now-30m"
16interval = "60m"
17index = ["filebeat-*", "logs-okta*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "Multiple Okta Client Addresses for a Single User Session"
21note = """## Setup
22
23The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
24references = [
25 "https://developer.okta.com/docs/reference/api/system-log/",
26 "https://developer.okta.com/docs/reference/api/event-types/",
27 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
28 "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection"
29]
30risk_score = 47
31rule_id = "cc382a2e-7e52-11ee-9aac-f661ea17fbcd"
32severity = "medium"
33tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Initial Access"]
34timestamp_override = "event.ingested"
35type = "threshold"
36query = '''
37event.dataset:okta.system
38 and okta.authentication_context.external_session_id:* and okta.debug_context.debug_data.dt_hash:*
39 and not (okta.actor.id: okta* or okta.actor.display_name: okta*)
40'''
41
42[[rule.threat]]
43framework = "MITRE ATT&CK"
44
45[[rule.threat.technique]]
46id = "T1078"
47name = "Valid Accounts"
48reference = "https://attack.mitre.org/techniques/T1078/"
49
50[[rule.threat.technique.subtechnique]]
51id = "T1078.004"
52name = "Cloud Accounts"
53reference = "https://attack.mitre.org/techniques/T1078/004/"
54
55[rule.threat.tactic]
56id = "TA0001"
57name = "Initial Access"
58reference = "https://attack.mitre.org/tactics/TA0001/"
59
60[rule.threshold]
61field = ["okta.actor.id", "okta.authentication_context.external_session_id"]
62value = 1
63
64[[rule.threshold.cardinality]]
65field = "okta.debug_context.debug_data.dt_hash"
66value = 2
Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
-
-
-
Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs
Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.
Read More -
Summary Okta has observed attacks in which a threat actor used social engineering to attain a highly privileged role in an Okta customer Organization (tenant). When successful, the threat actor demonstrated novel methods of lateral movement and defense evasion. These methods are preventable and present several detection opportunities for defenders. In recent weeks, multiple US-based Okta customers have reported a consistent pattern of so
Read More
Related rules
- Okta Sign-In Events via Third-Party IdP
- First Occurrence of Okta User Session Started via Proxy
- New Okta Authentication Behavior Detected
- Okta User Sessions Started from Different Geolocations
- Suspicious Activity Reported by Okta User