detection.wiki

Detection rules › Sigma

High Risk Actions - copying of the most powerful token through API Explorer

Status
experimental
Severity
medium
Log source
product auth0
Author
Okta
Source
github.com/auth0/auth0-customer-detections

The Auth0 Dashboard generates automatically a special token that is authorized to use all available Management API scopes (except for newly released scopes that shall be added manually). This token can be copied via Applications --> APIs --> Auth0 Management API --> API Explorer.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1528 Steal Application Access Token

Rule body yaml

title: High Risk Actions - copying of the most powerful token through API Explorer
id: 90a9a856-716d-11f0-bb81-723487b9527c
status: experimental
description: |
    The Auth0 Dashboard generates automatically a special token that is authorized to use all available Management API scopes
    (except for newly released scopes that shall be added manually).
    This token can be copied via Applications --> APIs --> Auth0 Management API --> API Explorer.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: seccft
        data.client_id: "{api_explorer_client_id}"
    condition: selection
explanation: The query simply collects entries issued when such a token is accessed via Dashboard.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=seccft data.client_id="{api_explorer_client_id}"
    OR data.client_name = "API Explorer Application"
    | fields data.user_id, data.user_name, data.ip
    ```Display the information in a table: user checking the secret and IP of this user```
    | table _time, data.user_id, data.user_name, data.ip
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name and a client_id for the API Explorer application.
tenant_logs: |
    type: "seccft" AND client_id: "{api_explorer_client_id}"
prevention:
    - Control tenant admins, i.e. "Admin", as this role has permissions to modify any application.
    - Enforce MFA for tenant admins to reduce the risk of an adversary gaining access.
    - Control usage of Management API from only trusted IPs by applying Network ACL scoped to "management".
    - Apply the least-privilige principle even for this client called "API Explorer Application" and reduce authorized scopes.
    - Reduce the token expiration time for this token that is 24 hours by default.
    - Delete this applcation known by default as "API Explorer Application" all together.
falsepositives:
    - Legitimate access by an administrator to read the API Explorer token.
level: medium
tags:
    - attack.credential-access
    - attack.t1528

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    data.type: seccft
    data.client_id: "{api_explorer_client_id}"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
data.client_ideq
  • {api_explorer_client_id}
data.typeeq
  • seccft