security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Potential Okta MFA Bombing via Push Notifications (#5073)

Browse Source 
* updated rule logic

* adjusted similar rule; added factor specification

* updated investigation guide

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
Terrance DeJesus
2025-09-11 16:24:09 -04:00
committed by GitHub
parent 7ff2648cfd
commit 02fcd43dbd
2 changed files with 53 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml
+26 -14
View File
@@ -2,7 +2,7 @@
creation_date = "2023/11/18"
integration = ["okta"]
maturity = "production"
updated_date = "2025/07/02"
updated_date = "2025/09/10"
[rule]
author = ["Elastic"]
@@ -12,7 +12,7 @@ user eventually accepts the Okta push notification. An adversary may attempt to
for an organization to obtain unauthorized access.
"""
event_category_override = "event.category"
index = ["filebeat-*", "logs-okta*"]
index = ["filebeat-*", "logs-okta.system*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Okta MFA Bombing via Push Notifications"
@@ -60,29 +60,41 @@ references = [
]
risk_score = 73
rule_id = "8a0fbd26-867f-11ee-947c-f661ea17fbcd"
setup = """## Setup
The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
"""
severity = "high"
tags = [
"Domain: Identity",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Data Source: Okta",
"Data Source: Okta System Logs",
"Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by okta.actor.id with maxspan=10m
[authentication where event.dataset == "okta.system"
and okta.event_type == "user.mfa.okta_verify.deny_push"] with runs=5
until [authentication where event.dataset == "okta.system"
and (okta.event_type: (
"user.authentication.sso",
"user.authentication.auth_via_mfa",
"user.authentication.verify",
"user.session.start") and okta.outcome.result == "SUCCESS")]
[ any
where event.dataset == "okta.system"
and (
okta.event_type == "user.mfa.okta_verify.deny_push"
or (
okta.event_type == "user.authentication.auth_via_mfa"
and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
and okta.outcome.reason == "INVALID_CREDENTIALS"
)
)
] with runs=5
until
[ any
where event.dataset == "okta.system"
and okta.event_type in (
"user.authentication.sso",
"user.authentication.auth_via_mfa",
"user.authentication.verify",
"user.session.start"
)
and okta.outcome.result == "SUCCESS"
]
'''
rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml
+27 -12
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/05"
integration = ["okta"]
maturity = "production"
updated_date = "2025/07/02"
updated_date = "2025/09/10"
[rule]
author = ["Elastic"]
@@ -12,13 +12,13 @@ user eventually accepts the Okta push notification. An adversary may attempt to
for an organization to obtain unauthorized access.
"""
event_category_override = "event.category"
index = ["filebeat-*", "logs-okta*"]
index = ["filebeat-*", "logs-okta.system*"]
language = "eql"
license = "Elastic License v2"
name = "Potentially Successful MFA Bombing via Push Notifications"
name = "Potentially Successful Okta MFA Bombing via Push Notifications"
note = """## Triage and analysis
### Investigating Potentially Successful MFA Bombing via Push Notifications
### Investigating Potentially Successful Okta MFA Bombing via Push Notifications
Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
@@ -65,23 +65,38 @@ risk_score = 73
rule_id = "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7"
severity = "high"
tags = [
"Domain: Identity",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Data Source: Okta",
"Data Source: Okta System Logs",
"Resources: Investigation Guide",
]
type = "eql"
query = '''
sequence by okta.actor.id with maxspan=10m
[authentication where event.dataset == "okta.system" and event.module == "okta"
and event.action == "user.mfa.okta_verify.deny_push"] with runs=3
[authentication where event.dataset == "okta.system" and event.module == "okta"
and (event.action : (
"user.authentication.sso",
"user.authentication.auth_via_mfa",
"user.authentication.verify",
"user.session.start") and okta.outcome.result == "SUCCESS")]
[ any
where event.dataset == "okta.system"
and (
okta.event_type == "user.mfa.okta_verify.deny_push"
or (
okta.event_type == "user.authentication.auth_via_mfa"
and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
and okta.outcome.reason == "INVALID_CREDENTIALS"
)
)
] with runs=5
[ any
where event.dataset == "okta.system"
and okta.event_type in (
"user.authentication.sso",
"user.authentication.auth_via_mfa",
"user.authentication.verify",
"user.session.start"
)
and okta.outcome.result == "SUCCESS"
]
'''