Attempt to Reset MFA Factors for an Okta User Account

calendar Oct 24, 2023 · Tactic: Persistence Use Case: Identity and Access Audit Data Source: Okta  ·
Share on: linkedin copy

Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/05/21"
 3integration = ["okta"]
 4maturity = "production"
 5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
 6min_stack_version = "8.10.0"
 7updated_date = "2023/10/24"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to
13reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in
14with normal activity in the victim's environment.
15"""
16false_positives = [
17    """
18    Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are
19    regularly reset in your organization.
20    """,
21]
22index = ["filebeat-*", "logs-okta*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Attempt to Reset MFA Factors for an Okta User Account"
26note = """## Setup
27
28The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30    "https://developer.okta.com/docs/reference/api/system-log/",
31    "https://developer.okta.com/docs/reference/api/event-types/",
32    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
33]
34risk_score = 21
35rule_id = "729aa18d-06a6-41c7-b175-b65b739b1181"
36severity = "low"
37tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta"]
38timestamp_override = "event.ingested"
39type = "query"
40
41query = '''
42event.dataset:okta.system and event.action:user.mfa.factor.reset_all
43'''
44
45
46[[rule.threat]]
47framework = "MITRE ATT&CK"
48[[rule.threat.technique]]
49id = "T1098"
50name = "Account Manipulation"
51reference = "https://attack.mitre.org/techniques/T1098/"
52
53
54[rule.threat.tactic]
55id = "TA0003"
56name = "Persistence"
57reference = "https://attack.mitre.org/tactics/TA0003/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top