Detection rules › Splunk
Okta Phishing Detection with FastPass Origin Check
The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the reason "FastPass declined phishing attempt." This activity is significant as it indicates that attackers are targeting users with real-time phishing proxies, attempting to capture credentials. If confirmed malicious, this could lead to unauthorized access to user accounts, potentially compromising sensitive information and furthering lateral movement within the organization.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078.001 Valid Accounts: Default Accounts |
| Persistence | T1078.001 Valid Accounts: Default Accounts, T1556 Modify Authentication Process |
| Privilege Escalation | T1078.001 Valid Accounts: Default Accounts |
| Stealth | T1078.001 Valid Accounts: Default Accounts |
| Defense Impairment | T1556 Modify Authentication Process |
| Credential Access | T1556 Modify Authentication Process |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- First Occurrence of Okta User Session Started via Proxy (Elastic)
- MFA Fatigue (OKTA) (Kusto)
- Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
- Okta Fast Pass phishing Detection (Kusto)
- Okta FastPass Phishing Detection (Sigma)
- Okta FastPass Phishing Detection (Elastic)
- Okta MFA Bruteforce Attack (YARA-L)
- Okta Mismatch Between Source And Response For Verify Push Request (YARA-L)
Rule body splunk
name: Okta Phishing Detection with FastPass Origin Check
id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
version: 9
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Okta, Inc, Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the reason "FastPass declined phishing attempt." This activity is significant as it indicates that attackers are targeting users with real-time phishing proxies, attempting to capture credentials. If confirmed malicious, this could lead to unauthorized access to user accounts, potentially compromising sensitive information and furthering lateral movement within the organization.
data_source:
- Okta
search: |-
`okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"
| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
BY user eventType client.userAgent.rawUserAgent
client.userAgent.browser outcome.reason
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `okta_phishing_detection_with_fastpass_origin_check_filter`
how_to_implement: This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
known_false_positives: Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
references:
- https://sec.okta.com/fastpassphishingdetection
finding:
title: Okta FastPass has prevented $user$ from authenticating to a malicious site.
entity:
field: user
type: user
score: 50
analytic_story:
- Okta Account Takeover
asset_type: Infrastructure
mitre_attack_id:
- T1078.001
- T1556
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: application
security_domain: access
Stages and Predicates
Stage 1: search
`okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
BY user eventType client.userAgent.rawUserAgent
client.userAgent.browser outcome.reason
Stage 3: search
| `security_content_ctime(firstTime)`
Stage 4: search
| `security_content_ctime(lastTime)`
Stage 5: search
| `okta_phishing_detection_with_fastpass_origin_check_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventType | eq |
|
outcome.reason | eq |
|
result | eq |
|
sourcetype | eq |
|