Auth0 CIC Credential Stuffing

Description

Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks. Okta has observed suspicious activity that started on April 15, 2024. Review tenant logs for unexpected fcoa and scoa events.

Query · python

from panther_auth0_helpers import auth0_alert_context

SUSPICIOUS_EVENT_TYPES = (
    "scoa",
    "fcoa",
)


def rule(event):
    return event.deep_get("data", "type") in SUSPICIOUS_EVENT_TYPES


def title(event):
    event_type = event.deep_get("data", "type")
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    return (
        f"Auth0 User [{user}] had a suspicious [{event_type}] event in "
        f"your organization's tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Analyst notes

If a user password was compromised in a credential stuffing attack, the user's credentials should be rotated immediately out of an abundance of caution.

Raw source Auth0 CIC Credential Stuffing · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
LogTypes:
  - Auth0.Events
RuleID: "Auth0.CIC.Credential.Stuffing"
Filename: auth0_cic_credential_stuffing.py
DisplayName: "Auth0 CIC Credential Stuffing"
Description: Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks.  Okta has observed suspicious activity that started on April 15, 2024.  Review tenant logs for unexpected fcoa and scoa events.
Enabled: true
Severity: High
Runbook: If a user password was compromised in a credential stuffing attack, the user's credentials should be rotated immediately out of an abundance of caution.
Reference: https://sec.okta.com/articles/2024/05/detecting-cross-origin-authentication-credential-stuffing-attacks
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - ExpectedResult: true
    Log:
      log_id: "90020241029185251974499000000000000001223372087732751235"
      data:
        audience: "https://shared.app-api.clientdomain.com"
        client_id: "EmEDkk1wKV0bmzZut3rbEC5vxBE6UiZV"
        client_name: "App Frontend"
        connection: "Username-Password-Authentication"
        connection_id: "con_BvGURiLLdngYaT0D"
        date: "2024-10-29 18:52:51.953000000"
        description: "Unable to configure verification page."
        details:
          body: {}
          connection: "Username-Password-Authentication"
          error:
            message: "Unable to configure verification page."
            oauthError: "server_error"
            type: "oauth-authorization"
          qs:
            _csrf: "TUReBWZ8-Fp9mvFrk6S3beuGrvKIkZVFfcKk"
            _intstate: "deprecated"
            audience: "https://shared.app-api.clientdomain.com"
            auth0Client: "eyJuYW1lIjoibG9jay5qcyIsInZlcnNpb24iOiIxMi4nYjOnsiYXV0aDAuanMiOiI5LjI2LjAifX0="
            client_id: "EmEDkk1wKV0bmzZut3rbE0C5vxBE6UiZV"
            code_challenge: "oDe_o-4xT4_qdBvbbDiHPlVyoNKglqtNKqYrzcZt72M"
            code_challenge_method: "S256"
            connection: "Username-Password-Authentication"
            login_hint: ""
            login_ticket: "Uyqi3p1wDRZIWomeW3XxbjmSiBYNHzT8"
            nonce: "eW9wRjRhTFpMNlYyNHNJT1NvRm1jUUl0sM2ZxYk80azZILjdSVnBMcy14cg=="
            protocol: "oauth2"
            realm: "Username-Password-Authentication"
            redirect_uri: "https://redirect.app.clientdomain.com"
            response_mode: "query"
            response_type: "code"
            scope: "openid profile email offline_access"
            screen_hint: "login"
            state: "hKFo2SBPSW1RRnlhcjhxUVJZLUVwNzI0SzVjM3ItT10E4NXdMdKFupWxvZ2luo3RpZNkgdWtpQXVpakxnRlZ5Tm1ER2k4a0szTXZXLXNFSzQ5cFajY2lk2SBFbUVEa2sxd0tWMGJtelp1dDNyYkVDNXZ4QkU2VWlaVg"
          session_id: "OJ0d2L-gDTvkmwEctP8d3XwtLD8Yu1qh"
        hostname: "auth.clientdomain.com"
        ip: "2605:59c8:3075:214:d003:e902:2b01:dc14"
        log_id: "90020241029185251974499000000000000001223372087732751235"
        scope:
          - "openid"
          - "profile"
          - "email"
          - "offline_access"
        type: "fcoa"
        user_agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"
    Name: FCOA Event

# ------ paired body: auth0_cic_credential_stuffing.py ------

from panther_auth0_helpers import auth0_alert_context

SUSPICIOUS_EVENT_TYPES = (
    "scoa",
    "fcoa",
)


def rule(event):
    return event.deep_get("data", "type") in SUSPICIOUS_EVENT_TYPES


def title(event):
    event_type = event.deep_get("data", "type")
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    return (
        f"Auth0 User [{user}] had a suspicious [{event_type}] event in "
        f"your organization's tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.