Attempt to Deactivate MFA for an Okta User Account

calendar Oct 24, 2023 · Tactic: Persistence Use Case: Identity and Access Audit Data Source: Okta  ·
Share on: linkedin copy

Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/05/20"
 3integration = ["okta"]
 4maturity = "production"
 5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
 6min_stack_version = "8.10.0"
 7updated_date = "2023/10/24"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for
13an Okta user account in order to weaken the authentication requirements for the account.
14"""
15false_positives = [
16    """
17    If the behavior of deactivating MFA for Okta user accounts is expected, consider adding exceptions to this rule to
18    filter false positives.
19    """,
20]
21index = ["filebeat-*", "logs-okta*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "Attempt to Deactivate MFA for an Okta User Account"
25note = """## Setup
26
27The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
28references = [
29    "https://developer.okta.com/docs/reference/api/system-log/",
30    "https://developer.okta.com/docs/reference/api/event-types/",
31    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
32]
33risk_score = 21
34rule_id = "cd89602e-9db0-48e3-9391-ae3bf241acd8"
35severity = "low"
36tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta"]
37timestamp_override = "event.ingested"
38type = "query"
39
40query = '''
41event.dataset:okta.system and event.action:user.mfa.factor.deactivate
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1098"
49name = "Account Manipulation"
50reference = "https://attack.mitre.org/techniques/T1098/"
51
52
53[rule.threat.tactic]
54id = "TA0003"
55name = "Persistence"
56reference = "https://attack.mitre.org/tactics/TA0003/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top