Okta Phishing Detection With Fastpass Origin Check

Severity: medium
Type: Alert
Time window: 1h
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

References

https://sec.okta.com/fastpassphishingdetection

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_phishing_detection_with_fastpass_origin_check {

  meta:
    author = "Google Cloud Security"
    description = "Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy."
    rule_id = "mr_07d1a26d-1132-4228-bd49-c8dd899c7792"
    rule_name = "Okta Phishing Detection With Fastpass Origin Check"
    reference = "https://sec.okta.com/fastpassphishingdetection"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "Phishing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1566/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_event_type = "user.authentication.auth_via_mfa"
    $login.security_result.action = "BLOCK"
    $login.security_result.category_details = "FastPass declined phishing attempt"
    $login.target.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Initial Access"
    $mitre_attack_technique = "Phishing"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $principal_user_email_addresses = array_distinct ($login.principal.user.email_addresses)
    $security_result_summary = array_distinct($login.security_result.summary)
    $target_user_email_addresses = array_distinct($login.target.user.email_addresses)
    $target_user_userid = array_distinct($login.target.user.userid)
    $security_result_risk_reason = array_distinct($login.security_result.detection_fields["Risk Reasons"])

  condition:
    $login
}

YARA-L rule structure

Condition

Fires when at least one $login event in the 1h window.

Events

`$login` `USER_LOGIN`

metadata.product_event_type = "user.authentication.auth_via_mfa"
security_result.action = "BLOCK"
security_result.category_details = "FastPass declined phishing attempt"

Match and correlation

Match key: $userid (target.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`principal_user_email_addresses`	`array_distinct ($login.principal.user.email_addresses)`
`security_result_summary`	`array_distinct($login.security_result.summary)`
`target_user_email_addresses`	`array_distinct($login.target.user.email_addresses)`
`target_user_userid`	`array_distinct($login.target.user.userid)`
`security_result_risk_reason`	`array_distinct($login.security_result.detection_fields["Risk Reasons"])`