MFA Deactivation with no Re-Activation for Okta User Account

 1[metadata]
 2creation_date = "2020/05/20"
 3integration = ["okta"]
 4maturity = "production"
 5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
 6min_stack_version = "8.10.0"
 7updated_date = "2023/12/16"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An
13adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the
14account.
15"""
16false_positives = [
17    """
18    If the behavior of deactivating MFA for Okta user accounts is expected, consider adding exceptions to this rule to
19    filter false positives.
20    """,
21]
22from = "now-12h"
23index = ["filebeat-*", "logs-okta.system*"]
24interval = "6h"
25language = "eql"
26license = "Elastic License v2"
27name = "MFA Deactivation with no Re-Activation for Okta User Account"
28note = """## Triage and analysis
29
30### Investigating MFA Deactivation with no Re-Activation for Okta User Account
31
32MFA is used to provide an additional layer of security for user accounts. An adversary may achieve MFA deactivation for an Okta user account to achieve persistence.
33
34This rule fires when an Okta user account has MFA deactivated and no subsequent MFA reactivation is observed within 12 hours.
35
36#### Possible investigation steps:
37
38- Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.
39- Review `okta.target` or `user.target.full_name` fields to determine if deactivation was performed by a se parate user.
40- Using the `okta.actor.alternate_id` field, search  for MFA re-activation events where `okta.event_type` is `user.mfa.factor.activate`.
41- Review events where `okta.event_type` is `user.authenticate*` to determine if the user account had suspicious login activity.
42    - Geolocation details found in `client.geo*` related fields may be useful in determining if the login activity was suspicious for this user.
43
44#### False positive steps:
45
46- Determine with the target user if MFA deactivation was expected.
47- Determine if MFA is required for the target user account.
48
49#### Response and remediation:
50
51- If the MFA deactivation was not expected, consider deactivating the user
52    - This should be followed by resetting the user's password and re-enabling MFA.
53- If the MFA deactivation was expected, consider adding an exception to this rule to filter false positives.
54- Investigate the source of the attack. If a specific machine or network is compromised, additional steps may need to be taken to address the issue.
55- Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.
56- Check if the compromised account was used to access or alter any sensitive data, applications or systems.
57"""
58references = [
59    "https://developer.okta.com/docs/reference/api/system-log/",
60    "https://developer.okta.com/docs/reference/api/event-types/",
61    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
62]
63risk_score = 21
64rule_id = "cd89602e-9db0-48e3-9391-ae3bf241acd8"
65setup = "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.\n"
66severity = "low"
67tags = ["Tactic: Persistence", "Use Case: Identity and Access Audit", "Data Source: Okta", "Domain: Cloud"]
68type = "eql"
69
70query = '''
71sequence by okta.actor.id with maxspan=12h
72    [any where event.dataset == "okta.system" and okta.event_type == "user.mfa.factor.deactivate"
73        and okta.outcome.result == "SUCCESS" and not okta.client.user_agent.raw_user_agent like "SFDC-Callout*"]
74    ![any where event.dataset == "okta.system" and okta.event_type == "user.mfa.factor.activate"]
75'''
76
77
78[[rule.threat]]
79framework = "MITRE ATT&CK"
80[[rule.threat.technique]]
81id = "T1556"
82name = "Modify Authentication Process"
83reference = "https://attack.mitre.org/techniques/T1556/"
84[[rule.threat.technique.subtechnique]]
85id = "T1556.006"
86name = "Multi-Factor Authentication"
87reference = "https://attack.mitre.org/techniques/T1556/006/"
88
89
90
91[rule.threat.tactic]
92id = "TA0003"
93name = "Persistence"
94reference = "https://attack.mitre.org/tactics/TA0003/"