Attempt to Create Okta API Token
Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/05/21"
3integration = ["okta"]
4maturity = "production"
5updated_date = "2024/12/09"
6min_stack_version = "8.15.0"
7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an
13organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute
14techniques such as creating user accounts or disabling security rules or policies.
15"""
16false_positives = [
17 """
18 If the behavior of creating Okta API tokens is expected, consider adding exceptions to this rule to filter false
19 positives.
20 """,
21]
22index = ["filebeat-*", "logs-okta*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Attempt to Create Okta API Token"
26note = """## Setup
27
28The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30 "https://developer.okta.com/docs/reference/api/system-log/",
31 "https://developer.okta.com/docs/reference/api/event-types/",
32 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33 "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
34 "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
35]
36risk_score = 47
37rule_id = "96b9f4ea-0e8c-435b-8d53-2096e75fcac5"
38severity = "medium"
39tags = ["Use Case: Identity and Access Audit", "Data Source: Okta", "Tactic: Persistence"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:okta.system and event.action:system.api_token.create
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1136"
52name = "Create Account"
53reference = "https://attack.mitre.org/techniques/T1136/"
54
55
56[rule.threat.tactic]
57id = "TA0003"
58name = "Persistence"
59reference = "https://attack.mitre.org/tactics/TA0003/"
Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
-
-
-
Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs
Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.
Read More -
This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.
Read More -
This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.
Read More
Related rules
- Administrator Privileges Assigned to an Okta Group
- Administrator Role Assigned to an Okta User
- Attempt to Reset MFA Factors for an Okta User Account
- MFA Deactivation with no Re-Activation for Okta User Account
- Modification or Removal of an Okta Application Sign-On Policy