Okta Cleartext Passwords Extracted via SCIM Application

Description

An application admin has extracted cleartext user passwords via SCIM app. Malcious actors can extract plaintext passwords by creating a SCIM application under their control and configuring it to sync passwords from Okta.

Query · python

from panther_okta_helpers import okta_alert_context


def rule(event):
    return event.get(
        "eventType"
    ) == "application.lifecycle.update" and "Pushing user passwords" in event.deep_get(
        "outcome", "reason", default=""
    )


def title(event):
    target = event.deep_walk(
        "target", "alternateId", default="<alternateId-not-found>", return_val="first"
    )
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"extracted cleartext user passwords via SCIM app [{target}]"
    )


def alert_context(event):
    return okta_alert_context(event)
Raw source Okta Cleartext Passwords Extracted via SCIM Application · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: okta_password_extraction_via_scim.py
RuleID: "Okta.Password.Extraction.via.SCIM"
DisplayName: "Okta Cleartext Passwords Extracted via SCIM Application"
Enabled: true
LogTypes:
  - Okta.SystemLog
Reports:
  MITRE ATT&CK:
    - TA0006:T1556 # Modify Authentication Process
Severity: High
Description: >
  An application admin has extracted cleartext user passwords via SCIM app.
  Malcious actors can extract plaintext passwords by creating a SCIM application under their control and configuring it to sync passwords from Okta.
Reference: >
  https://www.authomize.com/blog/authomize-discovers-password-stealing-and-impersonation-risks-to-in-okta/
DedupPeriodMinutes: 30
Threshold: 1
Tests:
  - ExpectedResult: false
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Authentication of user via MFA
      eventtype: user.authentication.auth_via_mfa
      legacyeventtype: core.user.factor.attempt_fail
      outcome:
        result: SUCCESS
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: Other Event
  - ExpectedResult: true
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Authentication of user via MFA
      eventtype: application.lifecycle.update
      legacyeventtype: core.user.factor.attempt_fail
      outcome:
        reason: Pushing user passwords
        result: SUCCESS
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: FastPass Phishing Block Event


# ------ paired body: okta_password_extraction_via_scim.py ------

from panther_okta_helpers import okta_alert_context


def rule(event):
    return event.get(
        "eventType"
    ) == "application.lifecycle.update" and "Pushing user passwords" in event.deep_get(
        "outcome", "reason", default=""
    )


def title(event):
    target = event.deep_walk(
        "target", "alternateId", default="<alternateId-not-found>", return_val="first"
    )
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"extracted cleartext user passwords via SCIM app [{target}]"
    )


def alert_context(event):
    return okta_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.