Auth0 Attack Protection Monitoring Disabled

Description

An attack protection monitoring configuration was changed.

Query · python

from panther_auth0_helpers import auth0_alert_context, is_auth0_config_event


def rule(event):

    data_type = event.deep_get("data", "type", default="<NO_DATA_TYPE_FOUND>")

    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")

    request_path = event.deep_get(
        "data", "details", "request", "path", default="<NO_REQUEST_PATH_FOUND>"
    )

    response_body_enabled = event.deep_get(
        "data", "details", "response", "body", "enabled", default="<NO_ENABLED_INFO_FOUND>"
    )

    response_body_shields = event.deep_get(
        "data", "details", "response", "body", "shields", default="<NO_SHIELD_INFO_FOUND>"
    )

    response_status_code = event.deep_get(
        "data", "details", "response", "statusCode", default="<NO_RESPONSE_CODE_FOUND>"
    )

    return all(
        [
            data_type == "sapi",
            (
                (
                    "Suspicious IP Throttling" in data_description
                    and request_path == "/v2/attack-protection/suspicious-ip-throttling"
                )
                or (
                    "Brute-force" in data_description
                    and request_path == "/v2/attack-protection/brute-force-protection"
                )
                or (
                    "Breached Password Detection" in data_description
                    and request_path == "/v2/attack-protection/breached-password-detection"
                )
            ),
            (
                (response_body_enabled is False or response_body_enabled == "disabled")
                or (
                    (response_body_enabled is True or response_body_enabled == "enabled")
                    and response_body_shields != "block"
                )
            ),
            response_status_code == 200,
            is_auth0_config_event(event),
        ]
    )


def title(event):
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")

    response_body_enabled = event.deep_get(
        "data", "details", "response", "body", "enabled", default="<NO_ENABLED_INFO_FOUND>"
    )

    response_body_shields = event.deep_get(
        "data", "details", "response", "body", "shields", default="<NO_SHIELD_INFO_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    return (
        f"Auth0 User [{user}] updated shields to [{response_body_shields}]"
        f"or set attack protection monitoring to [{response_body_enabled}]"
        f"with message [{data_description}] in"
        f"your organization's tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Analyst notes

Assess if this was done by the user for a valid business reason. Be vigilant to re-enable this setting as it's in the best security interest for your organization's security posture.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2025-10-16
Modified: 2025-10-16
Authored by: panther-labs
Source ID
Upstream: rules/auth0_rules/auth0_attack_protection_disabled.yml
Type: rule
Version: 1
References: https://github.com/auth0/auth0-customer-detections/tree/main/detections
Data sources: Auth0.Events

ATT&CK

TA0005 T1562

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.