Attempt to Reset MFA Factors for an Okta User Account
Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/05/21"
3integration = ["okta"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2023/08/17"
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to
13reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in
14with normal activity in the victim's environment.
15"""
16false_positives = [
17 """
18 Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are
19 regularly reset in your organization.
20 """,
21]
22index = ["filebeat-*", "logs-okta*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Attempt to Reset MFA Factors for an Okta User Account"
26note = """## Setup
27
28The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30 "https://developer.okta.com/docs/reference/api/system-log/",
31 "https://developer.okta.com/docs/reference/api/event-types/",
32 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33]
34risk_score = 21
35rule_id = "729aa18d-06a6-41c7-b175-b65b739b1181"
36severity = "low"
37tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta"]
38timestamp_override = "event.ingested"
39type = "query"
40
41query = '''
42event.dataset:okta.system and event.action:user.mfa.factor.reset_all
43'''
44
45
46[[rule.threat]]
47framework = "MITRE ATT&CK"
48[[rule.threat.technique]]
49id = "T1098"
50name = "Account Manipulation"
51reference = "https://attack.mitre.org/techniques/T1098/"
52
53
54[rule.threat.tactic]
55id = "TA0003"
56name = "Persistence"
57reference = "https://attack.mitre.org/tactics/TA0003/"
Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
Related rules
- Attempt to Deactivate MFA for an Okta User Account
- Modification or Removal of an Okta Application Sign-On Policy
- Administrator Privileges Assigned to an Okta Group
- Administrator Role Assigned to an Okta User
- Attempt to Create Okta API Token