2023-10-28 14:50:04 +04:00
|
|
|
title: Okta Admin Functions Access Through Proxy
|
|
|
|
|
id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309
|
2024-09-02 10:01:36 +02:00
|
|
|
status: test
|
2023-10-28 14:50:04 +04:00
|
|
|
description: Detects access to Okta admin functions through proxy.
|
|
|
|
|
references:
|
|
|
|
|
- https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
|
|
|
|
|
- https://dataconomy.com/2023/10/23/okta-data-breach/
|
|
|
|
|
- https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
|
|
|
|
|
author: Muhammad Faisal @faisalusuf
|
2024-08-12 12:02:50 +02:00
|
|
|
date: 2023-10-25
|
2023-10-28 14:50:04 +04:00
|
|
|
tags:
|
2024-08-12 12:02:50 +02:00
|
|
|
- attack.credential-access
|
2023-10-28 14:50:04 +04:00
|
|
|
logsource:
|
|
|
|
|
service: okta
|
|
|
|
|
product: okta
|
|
|
|
|
detection:
|
|
|
|
|
selection:
|
|
|
|
|
debugContext.debugData.requestUri|contains: 'admin'
|
|
|
|
|
securityContext.isProxy: 'true'
|
|
|
|
|
condition: selection
|
|
|
|
|
falsepositives:
|
|
|
|
|
- False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary
|
|
|
|
|
level: medium
|
