New Okta Identity Provider (IdP) Added by Admin

 1[metadata]
 2creation_date = "2023/11/06"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/12/09"
 6min_stack_version = "8.15.0"
 7min_stack_comments = "Breaking change at 8.15.0 for the Okta Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within
13Okta.
14"""
15from = "now-30m"
16index = ["filebeat-*", "logs-okta*"]
17interval = "15m"
18language = "kuery"
19license = "Elastic License v2"
20name = "New Okta Identity Provider (IdP) Added by Admin"
21note = """## Triage and analysis
22
23### Investigating New Okta Identity Provider (IdP) Added by Admin
24
25This rule detects the creation of a new Identity Provider (IdP) by a Super Administrator or Organization Administrator within Okta.
26
27#### Possible investigation steps:
28- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
29- Identify the IdP added by reviewing the `okta.target` field and determing if this IdP is authorized.
30- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
31- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
32- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
33- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
34- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
35
36### False positive analysis:
37- It might be a false positive if the action was part of a planned activity or performed by an authorized person.
38- Several unsuccessful attempts prior to this success, may indicate an adversary attempting to add an unauthorized IdP multiple times.
39
40### Response and remediation:
41- If the IdP is unauthorized, deactivate it immediately via the Okta console.
42- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
43- If the actor is unauthorized, deactivate their account via the Okta console.
44- If the actor is authorized, ensure that the actor's account is not compromised.
45- Reset the user's password and enforce MFA re-enrollment, if applicable.
46- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
47- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
48- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
49
50## Setup
51
52The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53"""
54references = [
55    "https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/",
56    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
57    "https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection",
58    "https://unit42.paloaltonetworks.com/muddled-libra/",
59    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
60    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
61]
62risk_score = 47
63rule_id = "29b53942-7cd4-11ee-b70e-f661ea17fbcd"
64severity = "medium"
65tags = ["Use Case: Identity and Access Audit", "Tactic: Persistence", "Data Source: Okta"]
66timestamp_override = "event.ingested"
67type = "query"
68
69query = '''
70event.dataset: "okta.system" and event.action: "system.idp.lifecycle.create" and okta.outcome.result: "SUCCESS"
71'''
72
73
74[[rule.threat]]
75framework = "MITRE ATT&CK"
76[[rule.threat.technique]]
77id = "T1556"
78name = "Modify Authentication Process"
79reference = "https://attack.mitre.org/techniques/T1556/"
80[[rule.threat.technique.subtechnique]]
81id = "T1556.007"
82name = "Hybrid Identity"
83reference = "https://attack.mitre.org/techniques/T1556/007/"
84
85
86
87[rule.threat.tactic]
88id = "TA0003"
89name = "Persistence"
90reference = "https://attack.mitre.org/tactics/TA0003/"

References

• Cloudflare’s investigation of the January 2022 Okta compromise

  

  Today at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result.

  
  Read More

• Testing your Okta visibility and detection with Dorothy and Elastic Security — Elastic Security Labs

  

  Dorothy is a tool for security teams to test their visibility and detection capabilities for their Okta environment. IAM solutions are frequently targeted by adversaries but poorly monitored. Learn how to get started with Dorothy in this post.

  
  Read More

• Cross-Tenant Impersonation: Prevention and Detection

  SummaryOkta has observed attacks in which a threat actor used social engineering to attain a highly privileged role in an Okta customer Orga

  
  Read More

• Threat Group Assessment: Muddled Libra (Updated)

  

  Muddled Libra continues to evolve. From social engineering to adaptation of new technologies, significant time is spent breaking down organizational defenses.

  
  Read More

• Monitoring Okta threats with Elastic Security — Elastic Security Labs

  

  This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details creating a lab environment with the Elastic Stack, integrating SIEM solutions, and Okta.

  
  Read More

• Starter guide to understanding Okta — Elastic Security Labs

  

  This article delves into Okta's architecture and services, laying a solid foundation for threat research and detection engineering. Essential reading for those aiming to master threat hunting and detection in Okta environments.

  
  Read More

Related rules

• Administrator Privileges Assigned to an Okta Group
• Administrator Role Assigned to an Okta User
• Attempt to Create Okta API Token
• Attempt to Reset MFA Factors for an Okta User Account
• MFA Deactivation with no Re-Activation for Okta User Account