Okta FastPass Phishing Detection

 1[metadata]
 2creation_date = "2023/05/07"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Austin Songer"]
 9description = "Detects when Okta FastPass prevents a user from authenticating to a phishing website.\n"
10index = ["filebeat-*", "logs-okta*"]
11language = "kuery"
12license = "Elastic License v2"
13name = "Okta FastPass Phishing Detection"
14note = """## Setup
15
16The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
17
18This rule requires Okta to have the following turned on:
19
20Okta Identity Engine - select 'Phishing Resistance for FastPass' under Settings > Features in the Admin Console.
21"""
22references = [
23    "https://developer.okta.com/docs/reference/api/system-log/",
24    "https://developer.okta.com/docs/reference/api/event-types/",
25    "https://sec.okta.com/fastpassphishingdetection",
26    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
27    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
28    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
29]
30risk_score = 47
31rule_id = "ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e"
32severity = "medium"
33tags = ["Tactic: Initial Access", "Use Case: Identity and Access Audit", "Data Source: Okta"]
34timestamp_override = "event.ingested"
35type = "query"
36
37query = '''
38event.dataset:okta.system and event.category:authentication and
39  okta.event_type:user.authentication.auth_via_mfa and event.outcome:failure and okta.outcome.reason:"FastPass declined phishing attempt"
40'''
41
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45[[rule.threat.technique]]
46id = "T1566"
47name = "Phishing"
48reference = "https://attack.mitre.org/techniques/T1566/"
49
50
51[rule.threat.tactic]
52id = "TA0001"
53name = "Initial Access"
54reference = "https://attack.mitre.org/tactics/TA0001/"

References

• System Log | Okta Developer

  Secure, scalable, and highly available authentication and user management for any app.

  
  Read More

• Event Types | Okta Developer

  Secure, scalable, and highly available authentication and user management for any app.

  
  Read More

• Detecting Real-Time Phishing Attacks

  

  In the last two installments in our series on phishing resistance, we discussed <a href="https://sec.okta.com/articles/2022/09/phishing-resistance-and

  
  Read More

• Cross-Tenant Impersonation: Prevention and Detection

  SummaryOkta has observed attacks in which a threat actor used social engineering to attain a highly privileged role in an Okta customer Orga

  
  Read More

• Monitoring Okta threats with Elastic Security — Elastic Security Labs

  

  This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.

  
  Read More

• Starter guide to understanding Okta — Elastic Security Labs

  

  This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.

  
  Read More

Related rules

• First Occurrence of Okta User Session Started via Proxy
• New Okta Authentication Behavior Detected
• Okta Sign-In Events via Third-Party IdP
• Suspicious Activity Reported by Okta User
• Unauthorized Access to an Okta Application