Okta User Account Lockout

Severity: medium
Type: Alert
Time window: 1h
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when a user's account is locked out or a user account has reached the lockout limit.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

References

https://www.okta.com/resources/whitepaper/how-adaptive-mfa-helps-mitigate-brute-force-attacks/

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.account.lock`: User account auto-locked
Okta	System Log event type `user.account.lock.limit`: User account lockout limit reached

Rules detecting the same action

These rules filter on the same operation.

Attempts to Brute Force an Okta User Account (Elastic)
Okta Multiple Accounts Locked Out (Splunk)
Okta User Account Locked (Panther)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_user_account_lockout {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user's account is locked out or a user account has reached the lockout limit."
    rule_id = "mr_b7d1d908-77db-4217-a170-44e0423c7fbe"
    rule_name = "Okta User Account Lockout"
    reference = "https://www.okta.com/resources/whitepaper/how-adaptive-mfa-helps-mitigate-brute-force-attacks/"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    (
        $login.metadata.product_event_type = "user.account.lock.limit" or
        $login.metadata.product_event_type = "user.account.lock"
    )
    $login.security_result.action = "BLOCK"
    $login.principal.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $principal_user_email_addresses = array_distinct ($login.principal.user.email_addresses)
    $security_result_summary = array_distinct($login.security_result.summary)
    $security_result_category_details = array_distinct($login.security_result.category_details)

  condition:
    $login
}

YARA-L rule structure

Condition

Fires when at least one $login event in the 1h window.

Events

`$login`

metadata.product_event_type = "user.account.lock.limit" or "user.account.lock"
security_result.action = "BLOCK"

Match and correlation

Match key: $userid (principal.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`principal_user_email_addresses`	`array_distinct ($login.principal.user.email_addresses)`
`security_result_summary`	`array_distinct($login.security_result.summary)`
`security_result_category_details`	`array_distinct($login.security_result.category_details)`