Techniques
Sample rules
Okta Successful Single Factor Authentication
- source: splunk
- technicques:
- T1586
- T1586.003
- T1078
- T1078.004
- T1621
Description
The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where “Okta Verify” is not used. This behavior is significant as it may indicate a misconfiguration, policy violation, or potential account takeover. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches or further exploitation within the environment.
Detection logic
`okta` action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
| stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method) by src_ip user action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| search targets !="Okta Verify"
| `okta_successful_single_factor_authentication_filter`