Browse Rules

Push Security Open Security Finding

Okta Login Without Push Marker

Push Security Phishing Attack

Push Security App Banner Acknowledged

Push Security New App Detected

Push Security Phishable MFA Method

Push Security New SaaS Account Created

Okta Login Without Push

Identifies successful Okta logins not followed by Push Security authorization within 60 minutes. Push Security provides additional identity verification beyond Okta MFA as a defense-in-depth strategy. Missing Push Security verification suggests compromised credentials, session hijacking, or MFA bypass where attackers satisfied Okta authentication but cannot complete additional verification.

Potential Compromised Okta Credentials

Identifies high-confidence credential compromise by detecting Okta login without Push Security verification followed by Push Security phishing attack within 60 minutes. This sequence indicates an attacker authenticated to Okta with stolen credentials then attempted MFA fatigue or push bombing attacks. The correlation of both events provides strong evidence of active account compromise requiring immediate response.

Push Security SaaS App MFA Method Changed

MFA method on SaaS app changed

Push Security Authorized IdP Login

Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.

Push Security Unauthorized IdP Login

Login to application with unauthorized identity provider which could indicate a SAMLjacking attack.

MFA Fatigue (OKTA)

MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into approving multi-factor authentication prompts, potentially compromising their own security. The query identifies MFA fatigue attempts in Okta by correlating repeated Okta Verify push requests, denied pushes, and eventual successful MFA authentication within the same session. Ref: https://www.okta.com/blog/identity-security/mfa-fatigue-growing-security-

AWS SendSSHPublicKey [splunk-awscloudtrail]

SendSSHPublicKey pushes an SSH public key to the specified EC2 instance for use by the specified user. While this service is designed to enhance security by eliminating the need for permanent SSH keys, it can also be exploited by threat actors if not properly secured, leading to unauthorized access, persistence, privilege escalation, or lateral movement. This use case detection when SendSSHPublicKey is called.

GitHub Organizations Delete Branch Ruleset

The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, an

GitHub Enterprise Delete Branch Ruleset

The following analytic detects when branch rules are deleted in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rules is critical as it could indicate attempts to bypass code review requirements and security controls. Branch deletion rules are essential security controls that enforce code review, prevent force pushes, and maintai

Auth0: MFA Notification Failure [splunk-auth0]

Threat actors may attempt to trigger MFA notifications but fail due to security policies, service disruptions, or rate limits, potentially as part of an attack to manipulate authentication flows. This use case detects failed attempts to send MFA push or SMS notifications, which could indicate an attacker probing MFA mechanisms or a disruption in authentication services.

GitHub Protected Branch Settings Changed

This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.