Attempt to Reset MFA Factors for an Okta User Account
Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/05/21"
3integration = ["okta"]
4maturity = "production"
5updated_date = "2024/12/09"
6min_stack_version = "8.15.0"
7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to
13reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in
14with normal activity in the victim's environment.
15"""
16false_positives = [
17 """
18 Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are
19 regularly reset in your organization.
20 """,
21]
22index = ["filebeat-*", "logs-okta*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Attempt to Reset MFA Factors for an Okta User Account"
26note = """## Setup
27
28The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30 "https://developer.okta.com/docs/reference/api/system-log/",
31 "https://developer.okta.com/docs/reference/api/event-types/",
32 "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33 "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
34 "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
35 "https://www.elastic.co/security-labs/okta-and-lapsus-what-you-need-to-know",
36]
37risk_score = 21
38rule_id = "729aa18d-06a6-41c7-b175-b65b739b1181"
39severity = "low"
40tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta"]
41timestamp_override = "event.ingested"
42type = "query"
43
44query = '''
45event.dataset:okta.system and event.action:user.mfa.factor.reset_all
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1098"
53name = "Account Manipulation"
54reference = "https://attack.mitre.org/techniques/T1098/"
55
56
57[rule.threat.tactic]
58id = "TA0003"
59name = "Persistence"
60reference = "https://attack.mitre.org/tactics/TA0003/"
Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
References
-
-
-
Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs
Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.
Read More -
This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.
Read More -
This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.
Read More -
The latest organization under the microscope of the LAPSUS$ group is Okta. Threat hunt for the recent breach targeting Okta users using these simple steps in Elastic
Read More
Related rules
- Administrator Privileges Assigned to an Okta Group
- Administrator Role Assigned to an Okta User
- Attempt to Create Okta API Token
- MFA Deactivation with no Re-Activation for Okta User Account
- Modification or Removal of an Okta Application Sign-On Policy