Okta New Behaviors Acessing Admin Console

Severity: high
Log types: Okta.SystemLog
Reference: https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Source: github.com/panther-labs/panther-analysis

New Behaviors Observed while Accessing Okta Admin Console. A user attempted to access the Okta Admin Console from a new device with a new IP.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts

Rule body yaml

AnalysisType: rule
Filename: okta_new_behavior_accessing_admin_console.py
RuleID: "Okta.New.Behavior.Accessing.Admin.Console"
DisplayName: "Okta New Behaviors Acessing Admin Console"
Enabled: true
LogTypes:
  - Okta.SystemLog
Reports:
  MITRE ATT&CK:
    - TA0001:T1078.004 # Valid Accounts: Cloud Accounts
Severity: High
Description: >
  New Behaviors Observed while Accessing Okta Admin Console.
  A user attempted to access the Okta Admin Console from a new device with a new IP.
Runbook: >
  Configure Authentication Policies (Application Sign-on Policies) for access to privileged applications, including the Admin Console, to require re-authentication “at every sign-in”.
  Turn on and test New Device and Suspicious Activity end-user notifications.
Reference: >
  https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: New Behavior Accessing Admin Console (behavior)
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                behaviors:
                  [
                    New Geo-Location=NEGATIVE,
                    New Device=POSITIVE,
                    New IP=POSITIVE,
                    New State=NEGATIVE,
                    New Country=NEGATIVE,
                    Velocity=NEGATIVE,
                    New City=NEGATIVE,
                  ] }, },
        displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
              result: CHALLENGE },
        published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                        country: United States,
                        geolocation:
                          { lat: 20,
                            lon: -25 },
                        postalCode: "12345",
                        state: Ohio,
                        ip: 1.3.2.4,
                        version: V4 }, } ] },
        securitycontext:
          { asNumber: 701,
            asOrg: verizon,
            domain: verizon.net,
            isProxy: false,
            isp: verizon },
        severity: INFO,
        target:
          [ { alternateId: Okta Admin Console,
              displayName: Okta Admin Console,
              type: AppInstance },
            { alternateId: peter.griffin@company.com,
              displayName: Peter Griffin,
              id: 0002222AAAA,
              type: User }, ],
        transaction:
          { detail: { },
            id: ABcDeFgG,
            type: WEB },
      uuid: AbC-123-XyZ,
        version: "0" }
  - Name: New Behavior Accessing Admin Console (logSecurityDataOnly)
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                logOnlySecurityData:
                  {
                    "risk": { "level": "LOW" },
                    "behaviors":
                      {
                        "New Geo-Location": "NEGATIVE",
                        "New Device": "POSITIVE",
                        "New IP": "POSITIVE",
                        "New State": "NEGATIVE",
                        "New Country": "NEGATIVE",
                        "Velocity": "NEGATIVE",
                        "New City": "NEGATIVE",
                      },
                  } } },
        displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
              result: CHALLENGE },
        published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                        country: United States,
                        geolocation:
                          { lat: 20,
                            lon: -25 },
                        postalCode: "12345",
                        state: Ohio,
                        ip: 1.3.2.4,
                        version: V4 } } ] },
        securitycontext:
          { asNumber: 701,
            asOrg: verizon,
            domain: verizon.net,
            isProxy: false,
            isp: verizon },
        severity: INFO,
          target:
            [ { alternateId: Okta Admin Console,
                displayName: Okta Admin Console,
                type: AppInstance },
              { alternateId: peter.griffin@company.com,
                displayName: Peter Griffin,
                id: 0002222AAAA,
                type: User } ],
        transaction:
          { detail: { },
            id: ABcDeFgG,
            type: WEB },
        uuid: AbC-123-XyZ,
          version: "0" }
  - Name: Not New Behavior
    ExpectedResult: false
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
              displayName: Homer Simpson,
              id: 00abc123,
              type: User },
          authenticationcontext:
            { authenticationStep: 0,
                externalSessionId: 100-abc-9999 },
          client:
            { device: Computer,
                geographicalContext:
                  { city: Springfield,
                      country: United States,
                      geolocation:
                        { lat: 20,
                            lon: -25 },
                      postalCode: "12345",
                      state: Ohio },
                ipAddress: 1.3.2.4,
                userAgent:
                  { browser: CHROME,
                      os: Mac OS X,
                      rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
              zone: "null" },
          debugcontext:
            { debugData:
                { requestId: AbCdEf12G,
                    requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                    url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                    logOnlySecurityData:
                      {
                        "risk": { "level": "LOW" },
                        "behaviors":
                          {
                            "New Geo-Location": "NEGATIVE",
                            "New Device": "NEGATIVE",
                            "New IP": "NEGATIVE",
                            "New State": "NEGATIVE",
                            "New Country": "NEGATIVE",
                            "Velocity": "NEGATIVE",
                            "New City": "NEGATIVE",
                          },
                      } } },
          displaymessage: Evaluation of sign-on policy,
          eventtype: policy.evaluate_sign_on,
          outcome:
            { reason: Sign-on policy evaluation resulted in CHALLENGE,
                result: CHALLENGE },
          published: "2022-06-22 18:18:29.015",
          request:
            { ipChain:
                [ { geographicalContext:
                      { city: Springfield,
                          country: United States,
                          geolocation:
                            { lat: 20,
                                lon: -25 },
                          postalCode: "12345",
                          state: Ohio,
                          ip: 1.3.2.4,
                          version: V4 } } ] },
          securitycontext:
            { asNumber: 701,
                asOrg: verizon,
                domain: verizon.net,
                isProxy: false,
                isp: verizon },
          severity: INFO,
          target:
            [ { alternateId: Okta Admin Console,
                  displayName: Okta Admin Console,
                  type: AppInstance },
              { alternateId: peter.griffin@company.com,
                  displayName: Peter Griffin,
                  id: 0002222AAAA,
                  type: User } ],
          transaction:
            { detail: { },
                id: ABcDeFgG,
                type: WEB },
          uuid: AbC-123-XyZ,
          version: "0" }
  - Name: New Behavior Accessing Admin Console (logSecurityDataOnly) - not jsonified string
    ExpectedResult: true
    Log:
      { actor:
          { alternateId: homer.simpson@duff.com,
            displayName: Homer Simpson,
            id: 00abc123,
            type: User },
        authenticationcontext:
          { authenticationStep: 0,
            externalSessionId: 100-abc-9999 },
        client:
          { device: Computer,
            geographicalContext:
              { city: Springfield,
                country: United States,
                geolocation:
                  { lat: 20,
                    lon: -25 },
                postalCode: "12345",
                state: Ohio },
            ipAddress: 1.3.2.4,
            userAgent:
              { browser: CHROME,
                os: Mac OS X,
                rawUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36 },
            zone: "null" },
        device:
          { name: Evil Computer },
        debugcontext:
          { debugData:
              { requestId: AbCdEf12G,
                requestUri: /api/v1/users/AbCdEfG/lifecycle/reset_factors,
                url: '/api/v1/users/AbCdEfG/lifecycle/reset_factors?',
                logOnlySecurityData: "{\"risk\":{\"level\":\"LOW\"},\"behaviors\":{\"New Geo-Location\":\"NEGATIVE\",\"New Device\":\"POSITIVE\",\"New IP\":\"POSITIVE\",\"New State\":\"NEGATIVE\",\"New Country\":\"NEGATIVE\",\"Velocity\":\"NEGATIVE\",\"New City\":\"NEGATIVE\"}}" }},
            displaymessage: Evaluation of sign-on policy,
            eventtype: policy.evaluate_sign_on,
            outcome:
              { reason: Sign-on policy evaluation resulted in CHALLENGE,
                result: CHALLENGE },
            published: "2022-06-22 18:18:29.015",
            request:
              { ipChain:
                  [ { geographicalContext:
                        { city: Springfield,
                          country: United States,
                          geolocation:
                            { lat: 20,
                              lon: -25 },
                          postalCode: "12345",
                          state: Ohio,
                          ip: 1.3.2.4,
                          version: V4 } } ] },
            securitycontext:
              { asNumber: 701,
                asOrg: verizon,
                domain: verizon.net,
                isProxy: false,
                isp: verizon },
            severity: INFO,
            target:
              [ { alternateId: Okta Admin Console,
                  displayName: Okta Admin Console,
                  type: AppInstance },
                { alternateId: peter.griffin@company.com,
                  displayName: Peter Griffin,
                  id: 0002222AAAA,
                  type: User } ],
            transaction:
              { detail: { },
                id: ABcDeFgG,
                type: WEB },
            uuid: AbC-123-XyZ,
            version: "0" }

Detection logic

Condition

eventtype eq "policy.evaluate_sign_on"
target.displayName contains "Okta Admin Console"
(debugContext.debugData.behaviors is_not_null and debugContext.debugData.behaviors contains "New Device=POSITIVE" and debugContext.debugData.behaviors contains "New IP=POSITIVE") or (debugContext.debugData.logOnlySecurityData.behaviors.New Device eq "POSITIVE" and debugContext.debugData.logOnlySecurityData.behaviors.New IP eq "POSITIVE")

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`debugContext.debugData.behaviors`	contains	`New Device=POSITIVE` `New IP=POSITIVE`
`debugContext.debugData.behaviors`	is_not_null	(no value, null check)
`debugContext.debugData.logOnlySecurityData.behaviors.New Device`	eq	`POSITIVE`
`debugContext.debugData.logOnlySecurityData.behaviors.New IP`	eq	`POSITIVE`
`target.displayName`	contains	`Okta Admin Console`

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`event_type`	`eventtype`
`severity`
`actor`
`client`
`request`
`outcome`
`target`
`debug_context`	`debugcontext`
`authentication_context`	`authenticationcontext`
`security_context`	`securitycontext`
`ips`	`p_any_ip_addresses`
`displayName`	`actor.displayName`
`alternateId`	`actor.alternateId`
`ipAddress`	`client.ipAddress`
`name`	`device.name`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)