Unauthorized Access to an Okta Application

calendar Sep 25, 2024 · Tactic: Initial Access Use Case: Identity and Access Audit Data Source: Okta  ·
Share on: linkedin copy

Identifies unauthorized access attempts to Okta applications.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2021/05/14"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Elastic", "Austin Songer"]
 9description = "Identifies unauthorized access attempts to Okta applications."
10index = ["filebeat-*", "logs-okta*"]
11language = "kuery"
12license = "Elastic License v2"
13name = "Unauthorized Access to an Okta Application"
14note = """## Setup
15
16The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
17references = [
18    "https://developer.okta.com/docs/reference/api/system-log/",
19    "https://developer.okta.com/docs/reference/api/event-types/",
20    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
21    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
22    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
23]
24risk_score = 21
25rule_id = "4edd3e1a-3aa0-499b-8147-4d2ea43b1613"
26severity = "low"
27tags = ["Tactic: Initial Access", "Use Case: Identity and Access Audit", "Data Source: Okta"]
28timestamp_override = "event.ingested"
29type = "query"
30
31query = '''
32event.dataset:okta.system and event.action:app.generic.unauth_app_access_attempt
33'''
34
35
36[[rule.threat]]
37framework = "MITRE ATT&CK"
38[[rule.threat.technique]]
39id = "T1078"
40name = "Valid Accounts"
41reference = "https://attack.mitre.org/techniques/T1078/"
42
43
44[rule.threat.tactic]
45id = "TA0001"
46name = "Initial Access"
47reference = "https://attack.mitre.org/tactics/TA0001/"
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50
51[rule.threat.tactic]
52id = "TA0005"
53name = "Defense Evasion"
54reference = "https://attack.mitre.org/tactics/TA0005/"
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57
58[rule.threat.tactic]
59id = "TA0003"
60name = "Persistence"
61reference = "https://attack.mitre.org/tactics/TA0003/"
62[[rule.threat]]
63framework = "MITRE ATT&CK"
64
65[rule.threat.tactic]
66id = "TA0004"
67name = "Privilege Escalation"
68reference = "https://attack.mitre.org/tactics/TA0004/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top