Okta ThreatInsight Suspected Password Spray Attack

Severity: medium
Type: Alert
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Okta's ThreatInsight can identify Password Spray attacks.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110.003` Brute Force: Password Spraying

References

https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `security.threat.detected`: Request from malicious IP detected by ThreatInsight

Rules detecting the same action

These rules filter on the same operation.

Device Registration from Malicious IP (Kusto)
Okta Security Threat Detected (Sigma)
Okta ThreatInsight Login Failure With High Unknown Users (YARA-L)
Okta ThreatInsight Security Threat Detected (Panther)
Okta ThreatInsight Suspected Bruteforce Attack (YARA-L)
Okta ThreatInsight Threat Detected (Splunk)
Okta ThreatInsight Threat Suspected Promotion (Elastic)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_threatinsight_suspected_password_spray_attack {

  meta:
    author = "Google Cloud Security"
    description = "Okta's ThreatInsight can identify Password Spray attacks."
    rule_id = "mr_4d081db5-7ea3-4300-8e0f-d7c7fcc1f662"
    rule_name = "Okta ThreatInsight Suspected Password Spray Attack"
    reference = "https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force: Password Spraying"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/003/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    $login.metadata.product_event_type = "security.threat.detected"
    $login.security_result.category_details = "Password Spray"

  outcome:
    $risk_score = max(
        // Baseline
        35 +
        // If the IP Address is marked as suspicious IP address by Okta ThreatInsight
        if($login.security_result.detection_fields["threatSuspected"] = "true", 30) +
        // Unauthorized target geographies
        if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) +
        if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 20)
    )
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force: Password Spraying"
    $target_user_agent = $login.network.http.user_agent
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = $login.principal.location.city
    $security_result_summary = array_distinct($login.security_result.summary)

  condition:
    $login
}

YARA-L rule structure

Condition

Fires when at least one $login event.

Events

`$login` `USER_UNCATEGORIZED`

metadata.product_event_type = "security.threat.detected"
security_result.category_details = "Password Spray"

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max( 35 + if($login.security_result.detection_fields["threatSuspected"] = "true", 30) + if($login.principal.ip_geo_artifact.location.country_or_region = "Cuba", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Iran", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "North Korea", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Russia", 20) + if($login.principal.ip_geo_artifact.location.country_or_region = "Syria", 20) )`
`target_user_agent`	`$login.network.http.user_agent`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`$login.principal.location.city`
`security_result_summary`	`array_distinct($login.security_result.summary)`