Okta ThreatInsight Suspected Bruteforce Attack

Severity: medium
Type: Alert
Time window: 1h
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110.001` Brute Force: Password Guessing

References

https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `security.threat.detected`: Request from malicious IP detected by ThreatInsight

Rules detecting the same action

These rules filter on the same operation.

Device Registration from Malicious IP (Kusto)
Okta Security Threat Detected (Sigma)
Okta ThreatInsight Login Failure With High Unknown Users (YARA-L)
Okta ThreatInsight Security Threat Detected (Panther)
Okta ThreatInsight Suspected Password Spray Attack (YARA-L)
Okta ThreatInsight Threat Detected (Splunk)
Okta ThreatInsight Threat Suspected Promotion (Elastic)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_threatinsight_suspected_brute_force_attack {

  meta:
    author = "Google Cloud Security"
    description = "Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs."
    rule_id = "mr_9537e888-7af7-491f-a5e2-3623e1798aba"
    rule_name = "Okta ThreatInsight Suspected Bruteforce Attack"
    reference = "https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force: Password Guessing"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/001/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $bruteforce.metadata.product_name = "Okta"
    $bruteforce.metadata.vendor_name = "Okta"
    $bruteforce.metadata.event_type = "USER_UNCATEGORIZED"
    $bruteforce.metadata.product_event_type = "security.threat.detected"
    $bruteforce.security_result.category_details = "Login Failures"
    $bruteforce.principal.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(
        35 +
        // If the IP Address is marked as suspicious IP address by Okta ThreatInsight
        if($bruteforce.security_result.detection_fields["threatSuspected"] = "true", 30) +
        // Unauthorized target geographies
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force: Password Guessing"
    $target_user_agent = array_distinct($bruteforce.network.http.user_agent)
    $principal_ip = array_distinct($bruteforce.principal.ip)
    $principal_ip_country = array_distinct($bruteforce.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($bruteforce.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($bruteforce.principal.location.city)
    $security_result_summary = array_distinct($bruteforce.security_result.summary)

  condition:
    $bruteforce
}

YARA-L rule structure

Condition

Fires when at least one $bruteforce event in the 1h window.

Events

`$bruteforce` `USER_UNCATEGORIZED`

metadata.product_event_type = "security.threat.detected"
security_result.category_details = "Login Failures"

Match and correlation

Match key: $userid (principal.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	max( 35 + if($bruteforce.security_result.detection_fields["threatSuspected"] = "true", 30) + if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) + if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) + if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) + if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) + if($bruteforce.principal.ip_geo_artifact.location.country_or_region = "Syria", 20) )
`target_user_agent`	`array_distinct($bruteforce.network.http.user_agent)`
`principal_ip`	`array_distinct($bruteforce.principal.ip)`
`principal_ip_country`	`array_distinct($bruteforce.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($bruteforce.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($bruteforce.principal.location.city)`
`security_result_summary`	`array_distinct($bruteforce.security_result.summary)`