[metadata]
creation_date = "2020/05/21"
maturity = "production"
updated_date = "2020/10/26"

[rule]
author = ["Elastic"]
description = """
Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt
to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend
in with normal activity in the victim's environment.
"""
false_positives = [
    """
    Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are
    regularly reset in your organization.
    """,
]
index = ["filebeat-*", "logs-okta*"]
language = "kuery"
license = "Elastic License"
name = "Attempt to Reset MFA Factors for an Okta User Account"
note = "The Okta Fleet integration or Filebeat module must be enabled to use this rule."
references = [
    "https://developer.okta.com/docs/reference/api/system-log/",
    "https://developer.okta.com/docs/reference/api/event-types/",
]
risk_score = 21
rule_id = "729aa18d-06a6-41c7-b175-b65b739b1181"
severity = "low"
tags = ["Elastic", "Identity", "Okta", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "query"

query = '''
event.dataset:okta.system and event.action:user.mfa.factor.reset_all
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"


[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
