Potential Okta Password in AlternateID Field

calendar Oct 28, 2023 · attack.credential_access attack.t1552  ·
Share on: linkedin copy

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Sigma rule (View on GitHub)

 1title: Potential Okta Password in AlternateID Field
 2id: 91b76b84-8589-47aa-9605-c837583b82a9
 3status: experimental
 4description: |
 5    Detects when a user has potentially entered their password into the
 6    username field, which will cause the password to be retained in log files.    
 7references:
 8    - https://developer.okta.com/docs/reference/api/system-log/
 9    - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
10    - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
11author: kelnage
12date: 2023/04/03
13modified: 2023/10/25
14tags:
15    - attack.credential_access
16    - attack.t1552
17logsource:
18    product: okta
19    service: okta
20detection:
21    selection:
22        legacyeventtype: 'core.user_auth.login_failed'
23    filter_main:
24        # Okta service account names start with 0oa
25        # Email addresses are the default format for Okta usernames, so attempt
26        # to exclude alternateIds that look like valid emails
27        # If your Okta configuration uses different character restrictions, you
28        # will need to update this regular expression to reflect that or disable the rule for your environment
29        # Possible false negatives are failed login attempts with a password that looks like a valid email address
30        actor.alternateid|re: '(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})'
31    condition: selection and not filter_main
32falsepositives:
33    - Unlikely
34level: high

References

Related rules

to-top