High risk event - risk of copying client credentials

title: High risk event - risk of copying client credentials
id: 2d7087d2-716d-11f0-ba3b-723487b9527c
status: experimental
description: |
    Detect potential risks of copying client credentials by monitoring if a client is read via the Dashboard or Management API.
    This can indicate that someone is trying to copy client credentials for malicious purposes.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: mgmt_api_read
        data.description: "Get client by ID"
        data.details.accessedSecrets{}: client_secret
        data.details.response.body.client_id:
            - "critical-client_id-1"
            - "critical-client_id-etc"
    condition: selection
explanation: >
    The query collects log entries captured when the application's settings are accessed.
    The Splunk query displays affected clients/applications copying user, IP, and counts a number of readings.
    Limit the detection to specific high risk clients, e.g. your main customer facing application.
    Alternatively, exclude applications where client authentication is not applicable, i.e. mobile apps and SPAs.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=mgmt_api_read data.description="Get client by ID"
    data.details.accessedSecrets{}=client_secret
    ``` Limit monitoring to a list of applicable applications ```
    ```data.details.response.body.client_id IN ("critical-client_id-1", "critical-client_id-etc")```
    | fields data.details.response.body.client_id, data.user_id, data.ip
    ```Display the information in a table: affected clients, user checking the secret and IP of this user```
    | rename data.details.response.body.client_id as client_id
    | rename data.user_id as user_id
    | rename data.ip as ip
    | stats count by client_id, user_id, ip
comments:
    - The Splunk query above, shall be tuned to reflect a valid tenant name and a list of clients (by client_id) to monitor.
tenant_logs: |
    type: "mgmt_api_read" AND description: "Get client by ID"
prevention:
    - Limit number of admins ("Admin", "Editor - Specific App", "Viewer - Config Settings").
    - Rotate client credentials periodically.
    - Stop relying on client_secret, but explore Private key JWT for client authentication.
falsepositives:
    - Legitimate access by an administrator to read client settings.
level: medium
tags:
    - attack.credential-access
    - attack.t1528