Okta Multiple Failed Requests To Access Applications

Severity: medium
Type: Hunt
Time window: 15m
Match by: parentNetworkSessionId
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects multiple failed requests to access applications

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1550.004` Use Alternate Authentication Material: Web Session Cookie

References

https://sec.okta.com/sessioncookietheft

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4625: An account failed to log on.
Security-Auditing	Event ID 4648: A logon was attempted using explicit credentials.
Okta	System Log event type `policy.evaluate_sign_on`: Sign-on policy evaluated
Okta	System Log event type `user.authentication.sso`: User SSO to application

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
High-Risk Admin Activity (Kusto)
Okta AiTM Session Cookie Replay (Elastic)
Okta Multiple Failed Requests to Access Applications (Splunk)
Okta New Admin Console Behaviours (Sigma)
Okta New Behaviors Acessing Admin Console (Panther)
Okta Potentially Stolen Session (Panther)
Okta Suspicious Use Of A Session Cookie (YARA-L)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_multiple_failed_requests_to_access_applications {

  meta:
    author = "Google Cloud Security"
    description = "Detects multiple failed requests to access applications"
    rule_id = "mr_171cce33-0367-4c46-918d-c9fe813b4418"
    rule_name = "Okta Multiple Failed Requests To Access Applications"
    reference = "https://sec.okta.com/sessioncookietheft"
    mitre_attack_tactic = "Defense Evasion, Lateral Movement"
    mitre_attack_technique = "Use Alternate Authentication Material: Web Session Cookie"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1550/004/"
    mitre_attack_version = "v13.1"
    type = "Hunt"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    $login.metadata.product_event_type = "policy.evaluate_sign_on"
    $login.target.resource.resource_subtype = "AppInstance"
    $login.security_result.action = "CHALLENGE"
    $login.network.parent_session_id = $parentNetworkSessionId

    $sso.metadata.event_type = "USER_LOGIN"
    $sso.metadata.product_event_type = "user.authentication.sso"
    $sso.security_result.action = "ALLOW"
    $sso.target.resource.resource_subtype = "AppInstance"
    $sso.network.parent_session_id = $parentNetworkSessionId

  match:
    $parentNetworkSessionId over 15m

  outcome:
    $risk_score = max(
        // Baseline
        35 +
        // Based on Okta Behavior Detection pattern analysis
        if($login.security_result.description = /New Geo-Location=POSITIVE/, 10) +
        if($login.security_result.description = /New Device=POSITIVE/, 20) +
        if($login.security_result.description = /New IP=POSITIVE/, 5) +
        if($login.security_result.description = /New City=POSITIVE/, 5) +
        if($login.security_result.description = /New State=POSITIVE/, 10) +
        if($login.security_result.description = /New Country=POSITIVE/, 10) +
        if($login.security_result.description = /Velocity=POSITIVE/, 10) +
        // Unauthorized target geographies
        if($login.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($login.target.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($login.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($login.target.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($login.target.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Defense Evasion, Lateral Movement"
    $mitre_attack_technique = "Use Alternate Authentication Material: Web Session Cookie"
    $principal_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $security_result_summary = array_distinct($login.security_result.summary)
    $principal_user_managers_email_addresses = array_distinct($login.principal.user.managers.email_addresses)
    $principal_user_userid = array_distinct($login.principal.user.userid)
    $app_names = array_distinct($login.target.resource.name)
    $dc_app_name = count_distinct($login.target.resource.name)
    $security_result_description = array_distinct($login.security_result.description)

  condition:
    $login and $sso and $dc_app_name > 5
}

YARA-L rule structure

Condition

Fires when at least one $login event in the 15m window and at least one $sso event in the 15m window and $dc_app_name > 5.

Events

`$login` `USER_UNCATEGORIZED`

metadata.product_event_type = "policy.evaluate_sign_on"
target.resource.resource_subtype = "AppInstance"
security_result.action = "CHALLENGE"

`$sso` `USER_LOGIN` (`4624`, `4625`, `4648`)

metadata.product_event_type = "user.authentication.sso"
security_result.action = "ALLOW"
target.resource.resource_subtype = "AppInstance"

Match and correlation

Match key: $parentNetworkSessionId (network.parent_session_id)
Within: 15m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	max( 35 + if($login.security_result.description = /New Geo-Location=POSITIVE/, 10) + if($login.security_result.description = /New Device=POSITIVE/, 20) + if($login.security_result.description = /New IP=POSITIVE/, 5) + if($login.security_result.description = /New City=POSITIVE/, 5) + if($login.security_result.description = /New State=POSITIVE/, 10) + if($login.security_result.description = /New Country=POSITIVE/, 10) + if($login.security_result.description = /Velocity=POSITIVE/, 10) + if($login.target.ip_geo_artifact.location.country_or_region = "Cuba", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Iran", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "North Korea", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Russia", 20) + if($login.target.ip_geo_artifact.location.country_or_region = "Syria", 20) )
`principal_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`security_result_summary`	`array_distinct($login.security_result.summary)`
`principal_user_managers_email_addresses`	`array_distinct($login.principal.user.managers.email_addresses)`
`principal_user_userid`	`array_distinct($login.principal.user.userid)`
`app_names`	`array_distinct($login.target.resource.name)`
`dc_app_name`	`count_distinct($login.target.resource.name)`
`security_result_description`	`array_distinct($login.security_result.description)`