security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] High Number of Okta User Password Reset or Unlock Attempts (#1200)

Browse Source 
* Update impact_iam_deactivate_mfa_device.toml
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

(cherry picked from commit 58ea49b092)
This commit is contained in:
Austin Songer
2021-05-14 19:52:02 +00:00
committed by github-actions[bot]
parent afa6f1b541
commit fcd29373d5
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml
+6 -5
View File
@@ -1,13 +1,13 @@
[metadata]
creation_date = "2020/08/19"
maturity = "production"
updated_date = "2021/05/10"
updated_date = "2021/05/12"
[rule]
author = ["Elastic"]
author = ["Elastic", "@BenB196", "Austin Songer"]
description = """
Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain
unauthorized access to an Okta user account using these methods and attempt to blend in with normal activity in their
Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain
unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their
target's environment and evade detection.
"""
false_positives = [
@@ -82,6 +82,7 @@ name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[rule.threshold]
field = ["okta.actor.id"]
field = ["okta.actor.alternate_id"]
value = 5