IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
High Number of Okta User Password Reset or Unlock Attempts
editHigh Number of Okta User Password Reset or Unlock Attempts
editIdentifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target’s environment and evade detection.
Rule type: threshold
Rule indices:
- filebeat-*
- logs-okta*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-60m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Use Case: Identity and Access Audit
- Data Source: Okta
- Use Case: Identity and Access Audit
- Tactic: Defense Evasion
Version: 103
Rule authors:
- Elastic
- @BenB196
- Austin Songer
Rule license: Elastic License v2
Investigation guide
editRule query
editevent.dataset:okta.system and
event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or
system.sms.send_account_unlock_message or system.sms.send_password_reset_message or
system.voice.send_account_unlock_call or system.voice.send_password_reset_call or
user.account.unlock_token)
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
-
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
-
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
-
Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
-
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/