Oktasaur

detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml

@@ -0,0 +1,102 @@
+name: Okta Mismatch Between Source and Response for Okta Verify Push Request
+id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a
+version: 1
+date: '2023-03-17'
+author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic.
+  For each Okta Verify Push challenge, the following two events are recorded in Okta System Log /
+  
+  Source of Push (Sign-In) /
+
+  eventType eq "system.push.send_factor_verify_push" /
+
+  User Push Response (Okta Verify client) /
+
+  eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" /
+
+  In sequence, the logic for the analytic - /
+  
+  * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) /
+
+  * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. /
+  * Creates a ratio of successful sign-ins to pushes. /
+
+  * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.'
+search: '`okta` eventType IN (system.push.send_factor_verify_push) OR
+  (eventType IN (user.authentication.auth_via_mfa)
+  debugContext.debugData.factor="OKTA_VERIFY_PUSH")
+  | eval groupby="authenticationContext.externalSessionId"
+  | eval group_push_time=_time
+  | bin span=2s group_push_time
+  | fillnull value=NULL
+  | stats min(_time) as _time by authenticationContext.externalSessionId eventType
+  debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress
+  client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby
+  | iplocation client.ipAddress
+  | fields - lat, lon, group_push_time
+  | stats min(_time) as _time dc(client.ipAddress) as dc_ip
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "outcome.result"="SUCCESS",1,0))) as total_pushes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="SUCCESS",1,0))) as total_successes
+  sum(eval(if(eventType="user.authentication.auth_via_mfa" AND
+  "outcome.result"="FAILURE",1,0))) as total_rejected
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source
+  sum(eval(if(eventType="system.push.send_factor_verify_push" AND
+  "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source
+  values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src
+  values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest
+  values(*) as * by groupby
+  | eval ratio = round(total_successes/total_pushes,2)
+  | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND
+  suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1621
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  - Okta MFA Exhaustion
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$
+  mitre_attack_id:
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - authenticationContext.externalSessionId 
+  - eventType
+  - debugContext.debugData.factor 
+  - outcome.result 
+  - actor.alternateId 
+  - client.device 
+  - client.ipAddress
+  - client.userAgent.rawUserAgent 
+  - debugContext.debugData.behaviors 
+  - group_push_time
+  risk_score: 64
+  security_domain: access

detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml

@@ -0,0 +1,72 @@
+name: Okta Multiple Failed Requests to Access Applications
+id: 1c21fed1-7000-4a2e-9105-5aaafa437247
+version: 1
+date: '2023-03-17'
+author: John Murphy, Okta, Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: /
+
+  * Retrieves policy evaluation and SSO details in events that contain the Application requested /
+
+  * Formats target fields so we can aggregate specifically on Applications (AppInstances) /
+
+  * Groups by User, Session and IP /
+
+  * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies /
+
+  * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.'
+search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) 
+    | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ")
+    | eval targets=mvfilter(targets LIKE "AppInstance%")
+    | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes 
+    by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress
+    | search total_challenges > 0
+    | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress
+    | fillnull
+    | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed"
+    | fields - count, targets
+    | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+- https://attack.mitre.org/techniques/T1538
+- https://attack.mitre.org/techniques/T1550/004
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$.
+  mitre_attack_id:
+  - T1550.004
+  - T1538
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time 
+  - authenticationContext.externalSessionId 
+  - targets 
+  - actor.alternateId 
+  - client.ipAddress
+  - eventType
+  risk_score: 56
+  security_domain: access

detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml

@@ -2,7 +2,7 @@ name: Okta Phishing Detection with FastPass Origin Check
 id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies.

detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml

@@ -0,0 +1,67 @@
+name: Okta Suspicious Use of a Session Cookie
+id: 71ad47d1-d6bd-4e0a-b35c-020ad9a6959e
+version: 1
+date: '2023-03-17'
+author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. /
+
+  * Retrieves policy evaluation events from successful authentication events. /
+
+  * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. / 
+
+  * Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.'
+search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN
+  (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip
+  values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as
+  userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list
+  values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser
+  dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip
+  values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId
+  | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1)
+  | `okta_suspicious_use_of_a_session_cookie_filter`'
+how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested.
+known_false_positives: False positives may be present based on organization size and configuration of Okta. 
+references:
+  - https://attack.mitre.org/techniques/T1539/
+tags:
+  analytic_story:
+  - Suspicious Okta Activity
+  asset_type: Infrastructure
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context: []
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A suspicious use of a session cookie was identified by user $actor.alternateId$. 
+  mitre_attack_id:
+  - T1539
+  nist:
+  - DE.CM
+  observable:
+  - name: actor.alternateId
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - client.ipAddress
+  - client.userAgent.rawUserAgent
+  - client.userAgent.os
+  - client.geographicalContext.city
+  - client.userAgent.browser
+  - device.os_platform
+  - debugContext.debugData.dtHash
+  - actor.alternateId
+  risk_score: 56
+  security_domain: access

detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml

@@ -2,7 +2,7 @@ name: Okta ThreatInsight Login Failure with High Unknown users
 id: 632663b0-4562-4aad-abe9-9f621a049738
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.

detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml

@@ -2,7 +2,7 @@ name: Okta ThreatInsight Suspected PasswordSpray Attack
 id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2
 version: 1
 date: '2023-03-09'
-author: Michael Haag, Splunk
+author: Okta, Inc, Michael Haag, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.