Okta AiTM Phishing Attempt Blocked by FastPass

Description

Okta FastPass detected a user targeted by attackers wielding real-time (AiTM) proxies.

Query · python

from panther_okta_helpers import okta_alert_context


def rule(event):
    return (
        event.get("eventType") == "user.authentication.auth_via_mfa"
        and event.deep_get("outcome", "result") == "FAILURE"
        and event.deep_get("outcome", "reason") == "FastPass declined phishing attempt"
    )


def title(event):
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"FastPass declined phishing attempt"
    )


def alert_context(event):
    return okta_alert_context(event)

Analyst notes

Protect sign-in flows by enforcing phishing-resistant authentication with Okta FastPass and FIDO2 WebAuthn.

Raw source Okta AiTM Phishing Attempt Blocked by FastPass · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: okta_phishing_attempt_blocked_by_fastpass.py
RuleID: "Okta.Phishing.Attempt.Blocked.FastPass"
DisplayName: "Okta AiTM Phishing Attempt Blocked by FastPass"
Enabled: true
LogTypes:
  - Okta.SystemLog
Reports:
  MITRE ATT&CK:
    - TA0001:T1566 # Phishing
    - TA0006:T1556 # Modify Authentication Process
    - TA0003:T1078.004 # Valid Accounts: Cloud Accounts
Severity: High
Description: >
  Okta FastPass detected a user targeted by attackers wielding real-time (AiTM) proxies.
Runbook: >
  Protect sign-in flows by enforcing phishing-resistant authentication with Okta FastPass and FIDO2 WebAuthn.
Reference: >
  https://sec.okta.com/fastpassphishingdetection
DedupPeriodMinutes: 30
Threshold: 1
Tests:
  - ExpectedResult: false
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Authentication of user via MFA
      eventtype: user.authentication.auth_via_mfa
      legacyeventtype: core.user.factor.attempt_fail
      outcome:
        reason: INVALID_CREDENTIALS
        result: FAILURE
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: Other Event
  - ExpectedResult: true
    Log:
      actor:
        alternateId: homer.simpson@duff.com
        displayName: Homer Simpson
        id: 00abc123
        type: User
      authenticationcontext:
        authenticationStep: 0
        externalSessionId: 100-abc-9999
      client:
        device: Computer
        geographicalContext:
          city: Springfield
          country: United States
          geolocation:
            lat: 20
            lon: -25
          postalCode: "12345"
          state: Ohio
        ipAddress: 1.3.2.4
        userAgent:
          browser: CHROME
          os: Mac OS X
          rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
        zone: "null"
      debugcontext:
        debugData:
          requestId: AbCdEf12G
          requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors
          url: /api/v1/users/AbCdEfG/lifecycle/reset_factors?
      displaymessage: Authentication of user via MFA
      eventtype: user.authentication.auth_via_mfa
      legacyeventtype: core.user.factor.attempt_fail
      outcome:
        reason: FastPass declined phishing attempt
        result: FAILURE
      published: "2022-06-22 18:18:29.015"
      request:
        ipChain:
          - geographicalContext:
              city: Springfield
              country: United States
              geolocation:
                lat: 20
                lon: -25
              postalCode: "12345"
              state: Ohio
            ip: 1.3.2.4
            version: V4
      securitycontext:
        asNumber: 701
        asOrg: verizon
        domain: verizon.net
        isProxy: false
        isp: verizon
      severity: INFO
      target:
        - alternateId: peter.griffin@company.com
          displayName: Peter Griffin
          id: 0002222AAAA
          type: User
      transaction:
        detail: {}
        id: ABcDeFgG
        type: WEB
      uuid: AbC-123-XyZ
      version: "0"
    Name: FastPass Phishing Block Event


# ------ paired body: okta_phishing_attempt_blocked_by_fastpass.py ------

from panther_okta_helpers import okta_alert_context


def rule(event):
    return (
        event.get("eventType") == "user.authentication.auth_via_mfa"
        and event.deep_get("outcome", "result") == "FAILURE"
        and event.deep_get("outcome", "reason") == "FastPass declined phishing attempt"
    )


def title(event):
    return (
        f"{event.deep_get('actor', 'displayName', default='<displayName-not-found>')} "
        f"<{event.deep_get('actor', 'alternateId', default='alternateId-not-found')}> "
        f"FastPass declined phishing attempt"
    )


def alert_context(event):
    return okta_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.