Detection rules › Panther
Panther rules: potential
| Rule | Severity |
|---|---|
| Potential Compromised Okta Credentials | critical |
Potential Compromised Okta Credentials
#Identifies high-confidence credential compromise by detecting Okta login without Push Security verification followed by Push Security phishing attack within 60 minutes. This sequence indicates an attacker authenticated to Okta with stolen credentials then attempted MFA fatigue or push bombing attacks. The correlation of both events provides strong evidence of active account compromise requiring immediate response.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | |
| Initial Access | |
| Credential Access |
Rule specification
AnalysisType: correlation_rule
RuleID: "Potential.Compromised.Okta.Credentials.Group"
DisplayName: "Potential Compromised Okta Credentials"
Enabled: false
Tags:
- Okta
- Push Security
- Credential Compromise
- Phishing
- Configuration Required
Reports:
MITRE ATT&CK:
- TA0001:T1078 # Initial Access: Valid Accounts
- TA0006:T1539 # Credential Access: Steal Web Session Cookie
- TA0006:T1598 # Credential Access: Phishing for Information
- TA0006:T1621 # Credential Access: Multi-Factor Authentication Request Generation
Severity: Critical
Description: >
Identifies high-confidence credential compromise by detecting Okta login without Push Security verification followed by Push Security phishing attack within 60 minutes. This sequence indicates an attacker authenticated to Okta with stolen credentials then attempted MFA fatigue or push bombing attacks. The correlation of both events provides strong evidence of active account compromise requiring immediate response.
Runbook: |
1. Query Okta System Log for all actions taken during the compromised session by actor.alternateId between the unauthorized login and Push Security phishing attack, looking for application access, data downloads, configuration changes, or privilege escalations
2. Review the Push Security phishing attack details to identify the attacker's tactics, timing, and social engineering methods, then analyze the source IP address from the Okta login using threat intelligence feeds to determine if it's associated with known malicious infrastructure
3. Query email logs and security awareness training platforms for phishing emails targeting the user in the 30 days before the compromise to identify the potential credential theft vector
Reference: https://www.okta.com/resources/datasheet/okta-adaptive-multi-factor-authentication-product-datasheet/
Detection:
- Group:
- ID: Login Without Push Marker
RuleID: Okta.Login.Without.Push.Marker
- ID: Push Phishing
RuleID: Push.Security.Phishing.Attack
MatchCriteria:
field_name:
- GroupID: Login Without Push Marker
Match: actor.alternateId
- GroupID: Push Phishing
Match: new.employee.email
Schedule:
RateMinutes: 1440
TimeoutMinutes: 10
LookbackWindowMinutes: 1800
Stages and Predicates
Fires when the steps below all occur within 30h, correlated by actor.alternateId, new.employee.email. Each step needs one match unless a higher minimum is shown.
Stage 1: step Login Without Push Marker
References detection Okta Login Without Push Marker.
Stage 2: step Push Phishing
References detection Push Security Phishing Attack.
Response runbook
1. Query Okta System Log for all actions taken during the compromised session by actor.alternateId between the unauthorized login and Push Security phishing attack, looking for application access, data downloads, configuration changes, or privilege escalations
2. Review the Push Security phishing attack details to identify the attacker's tactics, timing, and social engineering methods, then analyze the source IP address from the Okta login using threat intelligence feeds to determine if it's associated with known malicious infrastructure
3. Query email logs and security awareness training platforms for phishing emails targeting the user in the 30 days before the compromise to identify the potential credential theft vector