Okta User Failed Number Challenge During Push Notification

Severity: medium
Type: Alert
Time window: 1h
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when an Okta user failed a number challenge during push notification.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1621` Multi-Factor Authentication Request Generation

References

https://support.okta.com/help/s/article/Number-Challenge-for-Okta-Verify

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_user_failed_number_challenge_during_push_notification {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an Okta user failed a number challenge during push notification."
    rule_id = "mr_c5542a92-03d7-463a-bab8-ad10a6cd42f0"
    rule_name = "Okta User Failed Number Challenge During Push Notification"
    reference = "https://support.okta.com/help/s/article/Number-Challenge-for-Okta-Verify"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Multi-Factor Authentication Request Generation"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1621/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_event_type = "user.authentication.auth_via_mfa"
    $login.security_result.detection_fields["pushWithNumberChallengeResponseType"] = "OV_WITH_CHALLENGE_RESPONSE_INVALID"
    $login.security_result.action = "BLOCK"
    $login.target.user.userid = $userid

  match:
    $userid over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Multi-Factor Authentication Request Generation"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $principal_user_email_addresses = array_distinct ($login.principal.user.email_addresses)
    $security_result_summary = array_distinct($login.security_result.summary)
    $target_user_email_addresses = array_distinct($login.target.user.email_addresses)
    $target_user_userid = array_distinct($login.target.user.userid)

  condition:
    $login
}

YARA-L rule structure

Condition

Fires when at least one $login event in the 1h window.

Events

`$login` `USER_LOGIN`

metadata.product_event_type = "user.authentication.auth_via_mfa"
security_result.detection_fields["pushWithNumberChallengeResponseType"] = "OV_WITH_CHALLENGE_RESPONSE_INVALID"
security_result.action = "BLOCK"

Match and correlation

Match key: $userid (target.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`principal_user_email_addresses`	`array_distinct ($login.principal.user.email_addresses)`
`security_result_summary`	`array_distinct($login.security_result.summary)`
`target_user_email_addresses`	`array_distinct($login.target.user.email_addresses)`
`target_user_userid`	`array_distinct($login.target.user.userid)`