AnalysisType: rule
Filename: push_security_phishable_mfa_method.py
RuleID: "Push.Security.Phishable.MFA.Method"
DisplayName: "Push Security Phishable MFA Method"
Enabled: true
LogTypes:
- PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
Tests:
- Name: Dropbox Phishable MFA
ExpectedResult: true
Log:
id: d1e5794f-666d-4cba-abae-c6d889ca1903
new:
appId: 67ef5c13-b5e6-4945-af7b-c11ac98f630f
appType: DROPBOX
creationTimestamp: 1.707775048e+09
email: jet.black@issp.com
employeeId: ca6cf7ce-90e6-4eb5-a262-7899bc48c39c
id: 5e15ce4c-6b93-4fbf-aed9-1890775efa90
lastUsedTimestamp: null
loginMethods:
oidcLogin: null
oktaSwaLogin: false
passwordLogin: false
samlLogin: null
mfaMethods:
- SMS
- EMAIL_OTP
mfaRegistered: false
passwordId: null
object: ACCOUNT
old: null
- Name: Google Workspace Phishable MFA
ExpectedResult: true
Log:
id: d1e5794f-666d-4cba-abae-c6d889ca1903
new:
appId: 67ef5c13-b5e6-4945-af7b-c11ac98f630f
appType: GOOGLE_WORKSPACE
creationTimestamp: 1.707775048e+09
email: jet.black@issp.com
employeeId: ca6cf7ce-90e6-4eb5-a262-7899bc48c39c
id: 5e15ce4c-6b93-4fbf-aed9-1890775efa90
lastUsedTimestamp: null
loginMethods:
oidcLogin: null
oktaSwaLogin: false
passwordLogin: false
samlLogin: null
mfaMethods:
- SMS
- EMAIL_OTP
mfaRegistered: false
passwordId: null
object: ACCOUNT
old: null
- Name: No MFA Enabled
ExpectedResult: false
Log:
id: d1e5794f-666d-4cba-abae-c6d889ca1903
new:
appId: 67ef5c13-b5e6-4945-af7b-c11ac98f630f
appType: CONTENTFUL
creationTimestamp: 1.707775048e+09
email: jet.black@issp.com
employeeId: ca6cf7ce-90e6-4eb5-a262-7899bc48c39c
id: 5e15ce4c-6b93-4fbf-aed9-1890775efa90
lastUsedTimestamp: null
loginMethods:
oidcLogin: null
oktaSwaLogin: false
passwordLogin: false
samlLogin: null
mfaMethods: []
mfaRegistered: false
passwordId: null
object: ACCOUNT
old:
appId: 67ef5c13-b5e6-4945-af7b-c11ac98f630f
appType: CONTENTFUL
creationTimestamp: 1.707775048e+09
email: jet.black@issp.com
employeeId: ca6cf7ce-90e6-4eb5-a262-7899bc48c39c
id: 5e15ce4c-6b93-4fbf-aed9-1890775efa90
lastUsedTimestamp: null
loginMethods:
oidcLogin: null
oktaSwaLogin: false
passwordLogin: false
samlLogin: null
mfaMethods: []
mfaRegistered: false
passwordId: null
timestamp: 1.707775049e+09
type: CREATE
version: "1"
# ------ paired body: push_security_phishable_mfa_method.py ------
identity_providers = ("MICROSOFT_365", "GOOGLE_WORKSPACE", "OKTA", "JUMPCLOUD", "PING")
phishable_mfa = ("EMAIL_OTP", "PHONE_CALL", "SMS", "APP_PASSWORD")
def rule(event):
if event.get("object") != "ACCOUNT":
return False
mfa_methods = event.deep_get("new", "mfaMethods")
for method in mfa_methods:
if method in phishable_mfa:
return True
return False
def severity(event):
if event.deep_get("new", "appType") in identity_providers:
return "HIGH"
return "INFO"
def title(event):
mfa_methods = ", ".join(event.deep_get("new", "mfaMethods", default="No MFA"))
new_email = event.deep_get("new", "email")
app_type = event.deep_get("new", "appType", default=[])
return f"{new_email} using phishable MFA method with {app_type}. \
MFA methods enabled: {mfa_methods}"