From 3fd201bda68d466d9efec9eb8f27ce22f45f903e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 21 Mar 2023 09:38:36 -0600 Subject: [PATCH] Oktasaur --- ...e_and_response_for_verify_push_request.yml | 102 ++++++++++++++++++ ...failed_requests_to_access_applications.yml | 72 +++++++++++++ ...g_detection_with_fastpass_origin_check.yml | 2 +- ...kta_suspicious_use_of_a_session_cookie.yml | 67 ++++++++++++ ..._login_failure_with_high_unknown_users.yml | 2 +- ...insight_suspected_passwordspray_attack.yml | 2 +- 6 files changed, 244 insertions(+), 3 deletions(-) create mode 100644 detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml create mode 100644 detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml create mode 100644 detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml diff --git a/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml new file mode 100644 index 0000000000..bcc6dd46bc --- /dev/null +++ b/detections/experimental/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -0,0 +1,102 @@ +name: Okta Mismatch Between Source and Response for Okta Verify Push Request +id: 8085b79b-9b85-4e67-ad63-351c9e9a5e9a +version: 1 +date: '2023-03-17' +author: John Murphy and Jordan Ruocco, Okta, Michael Haag, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies variations in client-based values for source and response events to identify suspicious request behavior. The detection is enhanced if the org is evaluating behavior conditions in sign-on policies using Okta Behavior Detection. NOTE: This detection requires the use of Okta Identity Engine (OIE) and will not function on Okta Classic. + For each Okta Verify Push challenge, the following two events are recorded in Okta System Log / + + Source of Push (Sign-In) / + + eventType eq "system.push.send_factor_verify_push" / + + User Push Response (Okta Verify client) / + + eventType eq "user.authentication.auth_via_mfa" AND debugContext.debugData.factor eq "OKTA_VERIFY_PUSH" / + + In sequence, the logic for the analytic - / + + * Groups by SessionID and retrieves any system.push.send_factor_verify_push events (the source of the push) and user.authentication.auth_via_mfa events where the factor is OKTA_VERIFY_PUSH - (the user response to the push) / + + * Counts the total number of push events, successful authentication events, and any push sources where the client is a new device. / + * Creates a ratio of successful sign-ins to pushes. / + + * If the ratio (currently tuned aggressively) indicates push spam, or if a user has rejected a push, the detection proceeds to evaluate whether there is more than one IP address used during the session (session roaming) and the presence of both a new IP and new device during the session.' +search: '`okta` eventType IN (system.push.send_factor_verify_push) OR + (eventType IN (user.authentication.auth_via_mfa) + debugContext.debugData.factor="OKTA_VERIFY_PUSH") + | eval groupby="authenticationContext.externalSessionId" + | eval group_push_time=_time + | bin span=2s group_push_time + | fillnull value=NULL + | stats min(_time) as _time by authenticationContext.externalSessionId eventType + debugContext.debugData.factor outcome.result actor.alternateId client.device client.ipAddress + client.userAgent.rawUserAgent debugContext.debugData.behaviors group_push_time groupby + | iplocation client.ipAddress + | fields - lat, lon, group_push_time + | stats min(_time) as _time dc(client.ipAddress) as dc_ip + sum(eval(if(eventType="system.push.send_factor_verify_push" AND + "outcome.result"="SUCCESS",1,0))) as total_pushes + sum(eval(if(eventType="user.authentication.auth_via_mfa" AND + "outcome.result"="SUCCESS",1,0))) as total_successes + sum(eval(if(eventType="user.authentication.auth_via_mfa" AND + "outcome.result"="FAILURE",1,0))) as total_rejected + sum(eval(if(eventType="system.push.send_factor_verify_push" AND + "debugContext.debugData.behaviors" LIKE "%New Device=POSITIVE%",1,0))) as suspect_device_from_source + sum(eval(if(eventType="system.push.send_factor_verify_push" AND + "debugContext.debugData.behaviors" LIKE "%New IP=POSITIVE%",0,0))) as suspect_ip_from_source + values(eval(if(eventType="system.push.send_factor_verify_push","client.ipAddress",""))) as src + values(eval(if(eventType="user.authentication.auth_via_mfa","client.ipAddress",""))) as dest + values(*) as * by groupby + | eval ratio = round(total_successes/total_pushes,2) + | search ((ratio < 0.5 AND total_pushes > 1) OR (total_rejected > 0)) AND dc_ip > 1 AND + suspect_device_from_source > 0 AND suspect_ip_from_source > 0 | `okta_mismatch_between_source_and_response_for_verify_push_request_filter`' +how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested. +known_false_positives: False positives may be present based on organization size and configuration of Okta. Monitor, tune and filter as needed. +references: + - https://attack.mitre.org/techniques/T1621 +tags: + analytic_story: + - Suspicious Okta Activity + - Okta MFA Exhaustion + asset_type: Infrastructure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: [] + dataset: [] + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: A mismatch between source and response for verifying a push request has occurred for $actor.alternateId$ + mitre_attack_id: + - T1621 + nist: + - DE.CM + observable: + - name: actor.alternateId + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - authenticationContext.externalSessionId + - eventType + - debugContext.debugData.factor + - outcome.result + - actor.alternateId + - client.device + - client.ipAddress + - client.userAgent.rawUserAgent + - debugContext.debugData.behaviors + - group_push_time + risk_score: 64 + security_domain: access diff --git a/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml new file mode 100644 index 0000000000..0f20cf5db1 --- /dev/null +++ b/detections/experimental/application/okta_multiple_failed_requests_to_access_applications.yml @@ -0,0 +1,72 @@ +name: Okta Multiple Failed Requests to Access Applications +id: 1c21fed1-7000-4a2e-9105-5aaafa437247 +version: 1 +date: '2023-03-17' +author: John Murphy, Okta, Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'The following analytic identifies multiple failed app requests in an attempt to identify the reuse a stolen web session cookie. The logic of the analytic is as follows: / + + * Retrieves policy evaluation and SSO details in events that contain the Application requested / + + * Formats target fields so we can aggregate specifically on Applications (AppInstances) / + + * Groups by User, Session and IP / + + * Creates a ratio of successful SSO events to total MFA challenges related to Application Sign On Policies / + + * Alerts when more than half of app sign on events are unsuccessful, and challenges were unsatisfied for more than three apps.' +search: '`okta` target{}.type=AppInstance (eventType=policy.evaluate_sign_on outcome.result=CHALLENGE) OR (eventType=user.authentication.sso outcome.result=SUCCESS) + | eval targets=mvzip('target{}.type', 'target{}.displayName', ": ") + | eval targets=mvfilter(targets LIKE "AppInstance%") + | stats count min(_time) as _time values(outcome.result) as outcome.result dc(eval(if(eventType="policy.evaluate_sign_on",targets,NULL))) as total_challenges sum(eval(if(eventType="user.authentication.sso",1,0))) as total_successes + by authenticationContext.externalSessionId targets actor.alternateId client.ipAddress + | search total_challenges > 0 + | stats min(_time) as _time values(*) as * sum(total_challenges) as total_challenges sum(total_successes) as total_successes values(eval(if("outcome.result"="SUCCESS",targets,NULL))) as success_apps values(eval(if(":outcome.result"!="SUCCESS",targets,NULL))) as no_success_apps by authenticationContext.externalSessionId actor.alternateId client.ipAddress + | fillnull + | eval ratio=round(total_successes/total_challenges,2), severity="HIGH", mitre_technique_id="T1538", description="actor.alternateId". " from " . "client.ipAddress" . " seen opening " . total_challenges . " chiclets/apps with " . total_successes . " challenges successfully passed" + | fields - count, targets + | search ratio < 0.5 total_challenges > 2 | `okta_multiple_failed_requests_to_access_applications_filter`' +how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested. +known_false_positives: False positives may be present based on organization size and configuration of Okta. +references: +- https://attack.mitre.org/techniques/T1538 +- https://attack.mitre.org/techniques/T1550/004 +tags: + analytic_story: + - Suspicious Okta Activity + asset_type: Infrastructure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: [] + dataset: [] + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Multiple Failed Requests to Access Applications via Okta for $actor.alternateId$. + mitre_attack_id: + - T1550.004 + - T1538 + nist: + - DE.CM + observable: + - name: actor.alternateId + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - authenticationContext.externalSessionId + - targets + - actor.alternateId + - client.ipAddress + - eventType + risk_score: 56 + security_domain: access diff --git a/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml index 34a9f77ecf..71ecda866d 100644 --- a/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml +++ b/detections/experimental/application/okta_phishing_detection_with_fastpass_origin_check.yml @@ -2,7 +2,7 @@ name: Okta Phishing Detection with FastPass Origin Check id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3 version: 1 date: '2023-03-09' -author: Michael Haag, Splunk +author: Okta, Inc, Michael Haag, Splunk type: TTP datamodel: [] description: The following analytic identifies when Okta''s FastPass prevents known phishing sites. When your users are enrolled in FastPass, Okta can provide defenders a high-fidelity signal for when user applications are being targeted by attackers wielding real-time (AiTM) proxies. diff --git a/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml new file mode 100644 index 0000000000..a3043b8a18 --- /dev/null +++ b/detections/experimental/application/okta_suspicious_use_of_a_session_cookie.yml @@ -0,0 +1,67 @@ +name: Okta Suspicious Use of a Session Cookie +id: 71ad47d1-d6bd-4e0a-b35c-020ad9a6959e +version: 1 +date: '2023-03-17' +author: Scott Dermott and Felicity Robson, Okta, Michael Haag, Splunk +type: Hunting +datamodel: [] +description: 'The following analytic looks for one or more policy evaluation events in which multiple client values (IP, User Agent, etc.) change associated to the same Device Token for a specific user. A detection opportunity arises when an adversary attempts to reuse a stolen web session cookie. / + + * Retrieves policy evaluation events from successful authentication events. / + + * Aggregates/Groups by Device Token and User, providing the first policy evaluation event in the search window. / + + * Evaluates whether there is more than one IP and whether there is more than one OS or browser for each combination of User/Device Token.' +search: '`okta` eventType IN (policy.evaluate_sign_on) outcome.result IN + (ALLOW, SUCCESS) | stats earliest(_time) as _time values(client.ipAddress) as src_ip + values(client.userAgent.rawUserAgent) as user_agent values(client.userAgent.os) as + userAgentOS_list values(client.geographicalContext.city) as city values(client.userAgent.browser) as userAgentBrowser_list + values(device.os_platform) as okta_device_os dc(client.userAgent.browser) as dc_userAgentBrowser + dc(client.userAgent.os) as dc_userAgentOS dc(client.ipAddress) as dc_src_ip + values(outcome.reason) as reason by debugContext.debugData.dtHash actor.alternateId + | where dc_src_ip>1 AND (dc_userAgentOS>1 OR dc_userAgentBrowser>1) + | `okta_suspicious_use_of_a_session_cookie_filter`' +how_to_implement: This analytic is specific to Okta and requires Okta:im2 logs to be ingested. +known_false_positives: False positives may be present based on organization size and configuration of Okta. +references: + - https://attack.mitre.org/techniques/T1539/ +tags: + analytic_story: + - Suspicious Okta Activity + asset_type: Infrastructure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: [] + dataset: [] + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: A suspicious use of a session cookie was identified by user $actor.alternateId$. + mitre_attack_id: + - T1539 + nist: + - DE.CM + observable: + - name: actor.alternateId + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - client.ipAddress + - client.userAgent.rawUserAgent + - client.userAgent.os + - client.geographicalContext.city + - client.userAgent.browser + - device.os_platform + - debugContext.debugData.dtHash + - actor.alternateId + risk_score: 56 + security_domain: access diff --git a/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml b/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml index 2fda17bb5d..c978898608 100644 --- a/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml +++ b/detections/experimental/application/okta_threatinsight_login_failure_with_high_unknown_users.yml @@ -2,7 +2,7 @@ name: Okta ThreatInsight Login Failure with High Unknown users id: 632663b0-4562-4aad-abe9-9f621a049738 version: 1 date: '2023-03-09' -author: Michael Haag, Splunk +author: Okta, Inc, Michael Haag, Splunk type: TTP datamodel: [] description: The following analytic utilizes Okta's ThreatInsight to identify "Login failures with high unknown users count" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted. diff --git a/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml b/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml index fcb337b78a..8c8a24aa40 100644 --- a/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/detections/experimental/application/okta_threatinsight_suspected_passwordspray_attack.yml @@ -2,7 +2,7 @@ name: Okta ThreatInsight Suspected PasswordSpray Attack id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2 version: 1 date: '2023-03-09' -author: Michael Haag, Splunk +author: Okta, Inc, Michael Haag, Splunk type: TTP datamodel: [] description: The following analytic utilizes Okta's ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.