detection.wiki

Detection rules › Panther

Okta Support Reset Credential

Severity
high
Log types
Okta.SystemLog
Tags
Identity & Access Management, DataModel, Okta, Initial Access:Trusted Relationship
Reference
https://help.okta.com/en/prod/Content/Topics/Directory/get-support.htm#:~:text=Visit%20the%20Okta%20Help%20Center,1%2D800%2D219%2D0964
Source
github.com/panther-labs/panther-analysis

A Password or MFA factor was reset by Okta Support

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1199 Trusted Relationship

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: rule
Filename: okta_support_reset.py
RuleID: "Okta.Support.Reset"
DisplayName: "Okta Support Reset Credential"
Enabled: true
LogTypes:
  - Okta.SystemLog
Tags:
  - Identity & Access Management
  - DataModel
  - Okta
  - Initial Access:Trusted Relationship
Reports:
  MITRE ATT&CK:
    - TA0001:T1199
Severity: High
Description: A Password or MFA factor was reset by Okta Support
Reference: https://help.okta.com/en/prod/Content/Topics/Directory/get-support.htm#:~:text=Visit%20the%20Okta%20Help%20Center,1%2D800%2D219%2D0964
Runbook: Contact Admin to ensure this was sanctioned activity
DedupPeriodMinutes: 15
SummaryAttributes:
  - eventType
  - severity
  - p_any_ip_addresses
Tests:
  - Name: Support Reset Credential
    ExpectedResult: true
    Log:
      {
        "uuid": "12343",
        "published": "2021-11-29 18:56:40.014",
        "eventType": "user.account.reset_password",
        "version": "0",
        "severity": "INFO",
        "legacyEventType": "core.user.config.user_status.password_reset",
        "displayMessage": "Fired when the user's Okta password is reset",
        "actor":
          {
            "alternateId": "system@okta.com",
            "displayName": "system@okta.com",
            "id": "1111111",
            "type": "User",
          },
        "client":
          {
            "device": "Computer",
            "ipAddress": "1.1.1.1",
            "userAgent": { "browser": "CHROME", "os": "Mac OS X" },
            "zone": "null",
          },
        "outcome": { "result": "SUCCESS" },
        "target":
          [
            {
              "alternateId": "homer@springfield.gov",
              "displayName": "Homer Simpson",
              "id": "1111111",
              "type": "User",
            },
          ],
        "transaction": { "detail": {}, "id": "unknown", "type": "WEB" },
        "p_log_type": "Okta.SystemLog",
      }
  - Name: Reset by Company Admin
    ExpectedResult: false
    Log:
      {
        "uuid": "2aaaaaaaaaabbbbbbbbbbbbddddddddddd",
        "eventType": "user.account.reset_password",
        "version": "0",
        "severity": "INFO",
        "legacyEventType": "core.user.config.user_status.password_reset",
        "displayMessage": "Fired when the user's Okta password is reset",
        "actor":
          {
            "alternateId": "marge@springfield.gov",
            "displayName": "Marge Simpson",
            "id": "1111",
            "type": "User",
          },
        "client":
          {
            "device": "Computer",
            "geographicalContext":
              {
                "city": "Springfield",
                "country": "United States",
                "postalCode": "80014",
                "state": "Debated",
              },
            "ipAddress": "1.1.1.1",
            "userAgent":
              {
                "browser": "CHROME",
                "os": "Mac OS X",
                "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36",
              },
            "zone": "null",
          },
        "outcome": { "result": "SUCCESS" },
        "target":
          [
            {
              "alternateId": "homer@springfield.gov",
              "displayName": "Homer Simpson",
              "id": "1.1.1.1",
              "type": "User",
            },
          ],
        "transaction": { "detail": {}, "id": "1111", "type": "WEB" },
        "p_log_type": "Okta.SystemLog",
      }

Detection logic

Condition

eventType in ["user.account.reset_password", "user.mfa.factor.update", "system.mfa.factor.deactivate", "user.mfa.attempt_bypass"]
actor.alternateId eq "system@okta.com"
transaction.id eq "unknown"
userAgent.rawUserAgent is_null
client.geographicalContext.country is_null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actor.alternateIdeq
  • system@okta.com
client.geographicalContext.countryis_null
  • (no value, null check)
eventTypein
  • system.mfa.factor.deactivate
  • user.account.reset_password
  • user.mfa.attempt_bypass
  • user.mfa.factor.update
transaction.ideq
  • unknown
userAgent.rawUserAgentis_null
  • (no value, null check)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
event_typeeventtype
severity
actor
client
request
outcome
target
debug_contextdebugcontext
authentication_contextauthenticationcontext
security_contextsecuritycontext
ipsp_any_ip_addresses
actor_user