Okta User Rejected Multiple Push Notifications

Severity: medium
Type: Alert
Time window: 10m
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

References

https://sec.okta.com/pushfatigueworkflows

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA
Okta	System Log event type `user.mfa.okta_verify.deny_push`: Okta Verify push rejected by user

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule body

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule okta_user_rejected_multiple_push_notifications {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window."
    rule_id = "mr_4d8ac05a-0d73-4d81-a5a1-470d2bd7d725"
    rule_name = "Okta User Rejected Multiple Push Notifications"
    reference = "https://sec.okta.com/pushfatigueworkflows"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Brute Force"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1110/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Okta"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.product_name = "Okta"
    $login.metadata.vendor_name = "Okta"
    $login.metadata.event_type = "USER_UNCATEGORIZED"
    ($login.metadata.product_event_type = "user.mfa.okta_verify.deny_push" and $login.security_result.summary = "User rejected Okta push verify") or
    ($login.metadata.product_event_type = "user.authentication.auth_via_mfa" and $login.security_result.detection_fields["factor"] = "OKTA_VERIFY_PUSH")
    $login.security_result.action = "BLOCK"
    $login.principal.user.userid = $userid

  match:
    $userid over 10m

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Brute Force"
    $target_user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)
    $principal_ip_country = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($login.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($login.principal.location.city)
    $principal_user_email_addresses = array_distinct ($login.principal.user.email_addresses)
    $security_result_summary = array_distinct($login.security_result.summary)

  condition:
    #login >= 2
}

YARA-L rule structure

Condition

Fires when $login occurs at least 2 times in the 10m window.

Events

`$login` `USER_UNCATEGORIZED`

metadata.product_event_type = "user.mfa.okta_verify.deny_push"
security_result.summary = "User rejected Okta push verify"
metadata.product_event_type = "user.authentication.auth_via_mfa"
security_result.detection_fields["factor"] = "OKTA_VERIFY_PUSH"
security_result.action = "BLOCK"

Match and correlation

Match key: $userid (principal.user.userid)
Within: 10m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(35)`
`target_user_agent`	`array_distinct($login.network.http.user_agent)`
`principal_ip`	`array_distinct($login.principal.ip)`
`principal_ip_country`	`array_distinct($login.principal.ip_geo_artifact.location.country_or_region)`
`principal_ip_state`	`array_distinct($login.principal.ip_geo_artifact.location.state)`
`principal_ip_city`	`array_distinct($login.principal.location.city)`
`principal_user_email_addresses`	`array_distinct ($login.principal.user.email_addresses)`
`security_result_summary`	`array_distinct($login.security_result.summary)`