admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-03-21 13:00:24 -07:00
committed by GitHub
parent d3beb42623 b22e7ced59
commit 25ebbb46b9
3 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
+11 -10
View File
@@ -5,23 +5,24 @@ date: '2023-03-17'
author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
type: TTP
datamodel: []
description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.
For each Okta Verify Push challenge, the following two events are recorded in Okta System Log /
description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\
For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \
Source of Push (Sign-In) /
Source of Push (Sign-In) \
eventType eq "system.push.send_factor_verify_push" /
eventType eq \"system.push.send_factor_verify_push\" \
User Push Response (Okta Verify client) /
User Push Response (Okta Verify client) \
eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" /
eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \
In sequence, the logic for the analytic - /
In sequence, the logic for the analytic - \
* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) /
* Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \
* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. /
* Creates a ratio of successful sign-ins to pushes. /
* Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \
* Creates a ratio of successful sign-ins to pushes. \
* If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.'
search: '`okta` eventType IN (system.push.send_factor_verify_push) OR
detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml
+5 -6
View File
@@ -5,15 +5,14 @@ date: '2023-03-17'
author: John Murphy, Okta, Michael Haag, Splunk
type: Hunting
datamodel: []
description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: /
description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \
* Retrieves policy evaluation and SSO details in events that contain the Application requested \
* Retrieves policy evaluation and SSO details in events that contain the Application requested /
* Formats target fields so we can aggregate specifically on Applications (AppInstances) \
* Formats target fields so we can aggregate specifically on Applications (AppInstances) /
* Groups by User, Session and IP \
* Groups by User, Session and IP /
* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies /
* Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \
* Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`"
detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml
+3 -3
View File
@@ -5,11 +5,11 @@ date: '2023-03-17'
author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk
type: Hunting
datamodel: []
description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. /
description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \
* Retrieves policy evaluation events from successful authentication events. /
* Retrieves policy evaluation events from successful authentication events. \
* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. /
* Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \
* Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.'
search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN