diff --git a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index 2b3fead586..11df7e1884 100644 --- a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -5,23 +5,24 @@ date: '2023-03-17' author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk type: TTP datamodel: [] -description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic. - For each Okta Verify Push challenge, the following two events are recorded in Okta System Log / +description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.\ + + For each Okta Verify Push challenge, the following two events are recorded in Okta System Log \ - Source of Push (Sign-In) / + Source of Push (Sign-In) \ - eventType eq "system.push.send_factor_verify_push" / + eventType eq \"system.push.send_factor_verify_push\" \ - User Push Response (Okta Verify client) / + User Push Response (Okta Verify client) \ - eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" / + eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" \ - In sequence, the logic for the analytic - / + In sequence, the logic for the analytic - \ - * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) / + * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) \ - * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. / - * Creates a ratio of successful sign-ins to pushes. / + * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. \ + * Creates a ratio of successful sign-ins to pushes. \ * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.' search: '`okta` eventType IN (system.push.send_factor_verify_push) OR diff --git a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml index 47b34c2ee8..18d0385fbb 100644 --- a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml +++ b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml @@ -5,15 +5,14 @@ date: '2023-03-17' author: John Murphy, Okta, Michael Haag, Splunk type: Hunting datamodel: [] -description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: / +description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: \ + * Retrieves policy evaluation and SSO details in events that contain the Application requested \ - * Retrieves policy evaluation and SSO details in events that contain the Application requested / + * Formats target fields so we can aggregate specifically on Applications (AppInstances) \ - * Formats target fields so we can aggregate specifically on Applications (AppInstances) / + * Groups by User, Session and IP \ - * Groups by User, Session and IP / - - * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies / + * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies \ * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.' search: "`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) | eval targets=mvzip('target{}.type', 'target{}.displayName', \": \") | eval targets=mvfilter(targets LIKE \"AppInstance%\") | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType=\"policy.evaluate_sign_on\",targets,NULL))) as total_challenges sum(eval(if(eventType=\"user.authentication.sso\",1,0))) as total_successes by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress | search total_challenges > 0 | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if(\"outcome.result\"=\"SUCCESS\",targets,NULL))) as success_apps values(eval(if(\":outcome.result\"!=\"SUCCESS\",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress | fillnull | eval ratio=round(total_successes/total_challenges,2), severity=\"HIGH\", mitre_technique_id=\"T1538\", description=\"actor.alternateId\". \" from \" . \"client.ipAddress\" . \" seen opening \" . total_challenges . \" chiclets/apps with \" . total_successes . \" challenges successfully passed\" | fields - count, targets | search ratio < 0.5 total_challenges > 2` | okta_multiple_failed_requests_to_access_applications_filter`" diff --git a/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml index a3043b8a18..a421e72a16 100644 --- a/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml +++ b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml @@ -5,11 +5,11 @@ date: '2023-03-17' author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk type: Hunting datamodel: [] -description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. / +description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. \ - * Retrieves policy evaluation events from successful authentication events. / + * Retrieves policy evaluation events from successful authentication events. \ - * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. / + * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. \ * Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.' search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN