Elastic high stable eql

Potential Okta MFA Bombing via Push Notifications

Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.

View Source

Detection Logic

sequence by okta.actor.id with maxspan=10m
  [ any
    where data_stream.dataset == "okta.system"
      and (
        okta.event_type == "user.mfa.okta_verify.deny_push"
        or (
          okta.event_type == "user.authentication.auth_via_mfa"
          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
          and okta.outcome.reason == "INVALID_CREDENTIALS"
        )
      )
  ] with runs=5
  until
  [ any
    where data_stream.dataset == "okta.system"
      and okta.event_type in (
        "user.authentication.sso",
        "user.authentication.auth_via_mfa",
        "user.authentication.verify",
        "user.session.start"
      )
      and okta.outcome.result == "SUCCESS"
  ]

Field Validations

Loading…

Comments (0)

Loading comments...