Potential Compromised Okta Credentials

Description

Identifies high-confidence credential compromise by detecting Okta login without Push Security verification followed by Push Security phishing attack within 60 minutes. This sequence indicates an attacker authenticated to Okta with stolen credentials then attempted MFA fatigue or push bombing attacks. The correlation of both events provides strong evidence of active account compromise requiring immediate response.

Query

Detection:
  - Group:
      - ID: Login Without Push Marker
        RuleID: Okta.Login.Without.Push.Marker
      - ID: Push Phishing
        RuleID: Push.Security.Phishing.Attack
    MatchCriteria:
      field_name:
        - GroupID: Login Without Push Marker
          Match: actor.alternateId
        - GroupID: Push Phishing
          Match: new.employee.email
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10
    LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

  1. Query Okta System Log for all actions taken during the compromised session by actor.alternateId between the unauthorized login and Push Security phishing attack, looking for application access, data downloads, configuration changes, or privilege escalations
  2. Review the Push Security phishing attack details to identify the attacker's tactics, timing, and social engineering methods, then analyze the source IP address from the Okta login using threat intelligence feeds to determine if it's associated with known malicious infrastructure
  3. Query email logs and security awareness training platforms for phishing emails targeting the user in the 30 days before the compromise to identify the potential credential theft vector
Raw source Potential Compromised Okta Credentials · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Potential.Compromised.Okta.Credentials.Group"
DisplayName: "Potential Compromised Okta Credentials"
Enabled: false
Tags:
  - Okta
  - Push Security
  - Credential Compromise
  - Phishing
  - Configuration Required
Reports:
  MITRE ATT&CK:
    - TA0001:T1078 # Initial Access: Valid Accounts
    - TA0006:T1539 # Credential Access: Steal Web Session Cookie
    - TA0006:T1598 # Credential Access: Phishing for Information
    - TA0006:T1621 # Credential Access: Multi-Factor Authentication Request Generation
Severity: Critical
Description: >
  Identifies high-confidence credential compromise by detecting Okta login without Push Security verification followed by Push Security phishing attack within 60 minutes. This sequence indicates an attacker authenticated to Okta with stolen credentials then attempted MFA fatigue or push bombing attacks. The correlation of both events provides strong evidence of active account compromise requiring immediate response.
Runbook: |
  1. Query Okta System Log for all actions taken during the compromised session by actor.alternateId between the unauthorized login and Push Security phishing attack, looking for application access, data downloads, configuration changes, or privilege escalations
  2. Review the Push Security phishing attack details to identify the attacker's tactics, timing, and social engineering methods, then analyze the source IP address from the Okta login using threat intelligence feeds to determine if it's associated with known malicious infrastructure
  3. Query email logs and security awareness training platforms for phishing emails targeting the user in the 30 days before the compromise to identify the potential credential theft vector
Reference: https://www.okta.com/resources/datasheet/okta-adaptive-multi-factor-authentication-product-datasheet/
Detection:
  - Group:
      - ID: Login Without Push Marker
        RuleID: Okta.Login.Without.Push.Marker
      - ID: Push Phishing
        RuleID: Push.Security.Phishing.Attack
    MatchCriteria:
      field_name:
        - GroupID: Login Without Push Marker
          Match: actor.alternateId
        - GroupID: Push Phishing
          Match: new.employee.email
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10
    LookbackWindowMinutes: 1800
Tests:
  - Name: Login Without Marker, Followed By Phishing Detection
    ExpectedResult: true
    RuleOutputs:
      - ID: Login Without Push Marker
        Matches:
          actor.alternateId:
            frodo.baggins@hobbiton.com:
              - 0
      - ID: Push Phishing
        Matches:
          new.employee.email:
            frodo.baggins@hobbiton.com:
              - 3
  - Name: Login Without Marker, Followed By Phishing Detection for Different User
    ExpectedResult: false
    RuleOutputs:
      - ID: Login Without Push Marker
        Matches:
          actor.alternateId:
            frodo.baggins@hobbiton.com:
              - 0
      - ID: Push Phishing
        Matches:
          new.employee.email:
            samwise.gamgee@hobbiton.com:
              - 3
  - Name: Login Without Marker, Not Followed By Phishing Detection
    ExpectedResult: false
    RuleOutputs:
      - ID: Login Without Push Marker
        Matches:
          actor.alternateId:
            frodo.baggins@hobbiton.com:
              - 0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.