Okta ThreatInsight Login Failure With High Unknown Users

Severity: medium
Type: Alert
Time window: 1h
Match by: ip, userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110.004` Brute Force: Credential Stuffing

References

https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `security.threat.detected`: Request from malicious IP detected by ThreatInsight

Rules detecting the same action

These rules filter on the same operation.

Device Registration from Malicious IP (Kusto)
Okta Security Threat Detected (Sigma)
Okta ThreatInsight Security Threat Detected (Panther)
Okta ThreatInsight Suspected Bruteforce Attack (YARA-L)
Okta ThreatInsight Suspected Password Spray Attack (YARA-L)
Okta ThreatInsight Threat Detected (Splunk)
Okta ThreatInsight Threat Suspected Promotion (Elastic)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_threatinsight_login_failure_with_high_unknown_users {

  meta:
    author = "Google Cloud Security"
    description = "Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs."
    rule_id = "mr_41bafd12-7b1d-4b73-adf6-621c0431b538"
    rule_name = "Okta ThreatInsight Login Failure With High Unknown Users"
    reference = "https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force: Credential Stuffing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/004/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    $login.metadata.product_event_type = "security.threat.detected"
    $login.security_result.category_details = /Login failures with high unknown users count/
    $login.principal.user.userid = $userid
    $login.principal.ip = $ip

  match:
    $userid, $ip over 1h

  outcome:
    $risk_score = max(
        // Baseline
        35 +
        // If the IP Address is marked as suspicious IP address by Okta ThreatInsight
        if($login.security_result.detection_fields["threatSuspected"] = "true", 30) +
        // Unauthorized target geographies
        if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force: Credential Stuffing"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $security_result_summary = array_distinct($login.security_result.summary)

  condition:
    $login
}

YARA-L rule structure

Condition

Fires when at least one $login event in the 1h window.

Events

`$login` `USER_UNCATEGORIZED`

metadata.product_event_type = "security.threat.detected"
security_result.category_details matches "Login failures with high unknown users count"

Match and correlation

Match key: $ip (principal.ip), $userid (principal.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max( 35 + if($login.security_result.detection_fields["threatSuspected"] = "true", 30) + if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 20) )`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`security_result_summary`	`array_distinct($login.security_result.summary)`