Okta Fast Pass phishing Detection

Status: available
Severity: medium
Time window: 1h
Group by: actor_alternateId_s, actor_displayName_s, client_geographicalContext_city_s, client_geographicalContext_country_s, client_geographicalContext_state_s, client_ipAddress_s, client_userAgent_browser_s, client_userAgent_os_s, client_userAgent_rawUserAgent_s, displayMessage_s, outcome_reason_s, outcome_result_s, severity_s
Source: github.com/Azure/Azure-Sentinel

This query detects cases in which Okta FastPass effectively prevented access to a known phishing website.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)
Okta Mismatch Between Source And Response For Verify Push Request (YARA-L)

Rule body

id: 78d2b06c-8dc0-40e1-91c8-66d916c186f3
name: Okta Fast Pass phishing Detection
description: |
  This query detects cases in which Okta FastPass effectively prevented access to a known phishing website.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: OktaSSO
    dataTypes:
      - Okta_CL
  - connectorId: OktaSSOv2
    dataTypes:
      - OktaSSO
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1566.002
tags:
  - Okta
query: |
 // Add any known good IPs to this list to reduce noise
 let AllowedIPList = dynamic([]);
 OktaSSO
 | where isnotempty(client_ipAddress_s) and client_ipAddress_s !in (AllowedIPList)
 | where eventType_s == 'user.authentication.auth_via_mfa'
 | where outcome_result_s == 'FAILURE'
 | where outcome_reason_s == 'FastPass declined phishing attempt'
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,
  outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), column_ifexists('debugContext_debugData_threatSuspected_s', ""), client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_city_s, client_geographicalContext_country_s
 | extend Location = strcat(client_geographicalContext_city_s, "-", client_geographicalContext_country_s), AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: client_ipAddress_s
customDetails:
  UserAgent: client_userAgent_rawUserAgent_s
  UserAgentOS: client_userAgent_os_s
  UserAgentBrowser: client_userAgent_browser_s
  Location: Location
alertDetailsOverride:
  alertDisplayNameFormat: 'Okta FastPass phishing attempt declined for {{actor_alternateId_s}}'
  alertDescriptionFormat: 'Okta FastPass declined a phishing attempt for {{actor_alternateId_s}} from {{client_ipAddress_s}} using {{client_userAgent_browser_s}}.'
version: 1.1.2
kind: Scheduled

Stages and Predicates

Parameters

let AllowedIPList = dynamic([]);

Stage 1: `source`

OktaSSO

Stage 2: `where`

| where isnotempty(client_ipAddress_s) and client_ipAddress_s !in (AllowedIPList)

Stage 3: `where`

| where eventType_s == 'user.authentication.auth_via_mfa'

Stage 4: `where`

| where outcome_result_s == 'FAILURE'

Stage 5: `where`

| where outcome_reason_s == 'FastPass declined phishing attempt'

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,
 outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', ""), column_ifexists('debugContext_debugData_threatSuspected_s', ""), client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_city_s, client_geographicalContext_country_s

Stage 7: `extend`

| extend Location = strcat(client_geographicalContext_city_s, "-", client_geographicalContext_country_s), AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`client_ipAddress_s`	eq	`[]`	`excludes:client_ipAddress_s` `field:"client_ipAddress_s" value:"[]"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`client_ipAddress_s`	is_not_null	(no value, null check)	`field:"okta::client.ipAddress" kind:is_not_null`
`eventType_s`	eq	`user.authentication.auth_via_mfa`	`field:"okta::eventType" kind:eq value:"user.authentication.auth_via_mfa"`
`outcome_reason_s`	eq	`FastPass declined phishing attempt`	`field:"okta::outcome.reason" kind:eq value:"FastPass declined phishing attempt"`
`outcome_result_s`	eq	`FAILURE`	`field:"okta::outcome.result" kind:eq value:"FAILURE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`StartTime`	`summarize`
`actor_alternateId_s`	`summarize`
`actor_displayName_s`	`summarize`
`client_geographicalContext_city_s`	`summarize`
`client_geographicalContext_country_s`	`summarize`
`client_geographicalContext_state_s`	`summarize`
`client_ipAddress_s`	`summarize`
`client_userAgent_browser_s`	`summarize`
`client_userAgent_os_s`	`summarize`
`client_userAgent_rawUserAgent_s`	`summarize`
`displayMessage_s`	`summarize`
`outcome_reason_s`	`summarize`
`outcome_result_s`	`summarize`
`severity_s`	`summarize`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`
`Location`	`extend`