Okta Phishing Detection with FastPass Origin Check

Status: experimental
Severity: medium
Group by: "client.userAgent.browser", "client.userAgent.rawUserAgent", "outcome.reason", eventType, user
Author: Okta, Inc, Michael Haag, Splunk
Source: github.com/splunk/security_content

The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the reason "FastPass declined phishing attempt." This activity is significant as it indicates that attackers are targeting users with real-time phishing proxies, attempting to capture credentials. If confirmed malicious, this could lead to unauthorized access to user accounts, potentially compromising sensitive information and furthering lateral movement within the organization.

Known false positives

Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.001` Valid Accounts: Default Accounts
Persistence	`T1078.001` Valid Accounts: Default Accounts `T1556` Modify Authentication Process
Privilege Escalation	`T1078.001` Valid Accounts: Default Accounts
Stealth	`T1078.001` Valid Accounts: Default Accounts
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.authentication.auth_via_mfa`: User authenticated via MFA

Rules detecting the same action

These rules filter on the same operation.

First Occurrence of Okta User Session Started via Proxy (Elastic)
MFA Fatigue (OKTA) (Kusto)
Okta AiTM Phishing Attempt Blocked by FastPass (Panther)
Okta Authentication Failed During MFA Challenge (Splunk)
Okta Fast Pass phishing Detection (Kusto)
Okta FastPass Phishing Detection (Sigma)
Okta FastPass Phishing Detection (Elastic)
Okta MFA Bruteforce Attack (YARA-L)

Rule body

name: Okta Phishing Detection with FastPass Origin Check
id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
version: 9
creation_date: '2024-04-17'
modification_date: '2026-05-13'
author: Okta, Inc, Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies failed user authentication attempts in Okta due to FastPass declining a phishing attempt. It leverages Okta logs, specifically looking for events where multi-factor authentication (MFA) fails with the reason "FastPass declined phishing attempt." This activity is significant as it indicates that attackers are targeting users with real-time phishing proxies, attempting to capture credentials. If confirmed malicious, this could lead to unauthorized access to user accounts, potentially compromising sensitive information and furthering lateral movement within the organization.
data_source:
    - Okta
search: |-
    `okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"
      | stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
        BY user eventType client.userAgent.rawUserAgent
           client.userAgent.browser outcome.reason
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `okta_phishing_detection_with_fastpass_origin_check_filter`
how_to_implement: This search is specific to Okta and requires Okta logs to be ingested in your Splunk deployment.
known_false_positives: Fidelity of this is high as Okta is specifying malicious infrastructure. Filter and modify as needed.
references:
    - https://sec.okta.com/fastpassphishingdetection
finding:
    title: Okta FastPass has prevented $user$ from authenticating to a malicious site.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
asset_type: Infrastructure
mitre_attack_id:
    - T1078.001
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

Stages and Predicates

Stage 1: `search`

`okta` eventType="user.authentication.auth_via_mfa" AND result="FAILURE" AND outcome.reason="FastPass declined phishing attempt"

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime values(displayMessage)
    BY user eventType client.userAgent.rawUserAgent
       client.userAgent.browser outcome.reason

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `okta_phishing_detection_with_fastpass_origin_check_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventType`	eq	`"user.authentication.auth_via_mfa"`	`field:"eventType" kind:eq`
`outcome.reason`	eq	`"FastPass declined phishing attempt"`	`field:"outcome.reason" kind:eq`
`result`	eq	`"FAILURE"`	`field:"result" kind:eq`
`sourcetype`	eq	`OktaIM2:log`	`field:"sourcetype" kind:eq value:"OktaIM2:log"`