security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
integration-v8.11.21
sigma-rules/rules/integrations/okta
T
History
Terrance DeJesus 408442e185 [Rule Tuning] Multiple Device Token Hashes for Single Okta Session (#3814) 
* tuning 'Multiple Device Token Hashes for Single Okta Session'

* adjusted file name

* updated tags

* updated file name extension

* updated min-stack comments

(cherry picked from commit 2e3aca62f0)
2024-06-28 17:02:28 +00:00
..
credential_access_attempted_bypass_of_okta_mfa.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
credential_access_attempts_to_brute_force_okta_user_account.toml
[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368)
2024-01-17 19:20:19 +00:00
credential_access_multiple_auth_events_from_single_device_behind_proxy.toml
[Rule Tuning] Multiple Users with the Same Okta Device Token Hash (#3304)
2023-12-06 15:41:15 +00:00
credential_access_okta_brute_force_or_password_spraying.toml
[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368)
2024-01-17 19:20:19 +00:00
credential_access_okta_mfa_bombing_via_push_notifications.toml
[Security Content] Small tweaks on the setup guides (#3308)
2024-03-11 12:15:22 +00:00
credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml
[New Rule] Okta MFA Bombing Attempt (#3278)
2023-11-28 14:21:18 +00:00
credential_access_user_impersonation_access.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_attempt_to_deactivate_okta_network_zone.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_attempt_to_delete_okta_network_zone.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_deactivate_okta_policy.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_delete_okta_policy.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_modify_okta_network_zone.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_okta_attempt_to_modify_okta_policy.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml
[Rule Tuning] Update timestamp_override Unit Tests and Fix Rules Missing Field (#3368)
2024-01-17 19:20:19 +00:00
impact_attempt_to_revoke_okta_api_token.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
impact_okta_attempt_to_deactivate_okta_application.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
impact_okta_attempt_to_delete_okta_application.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
impact_okta_attempt_to_modify_okta_application.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
impact_possible_okta_dos_attack.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
initial_access_first_occurrence_user_session_started_via_proxy.toml
[New Rule] Adding Detection for First Occurrence of Okta User Session Started via Proxy (#3261)
2023-11-27 22:55:16 +00:00
initial_access_new_authentication_behavior_detection.toml
[New Rule] Adding Detection for New Okta Authentication Behavior (#3260)
2023-11-27 22:44:18 +00:00
initial_access_okta_fastpass_phishing.toml
updating min-stack for Okta rule (#3318)
2023-12-12 17:32:32 +00:00
initial_access_okta_user_attempted_unauthorized_access.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
initial_access_okta_user_sessions_started_from_different_geolocations.toml
[New Rule] Adding Detection Logic for Okta User Sessions Started from Different Geolocations (#3279)
2023-11-21 22:37:18 +00:00
initial_access_sign_in_events_via_third_party_idp.toml
[New Rule] Detection for Okta Sign-In Events via Third-Party IdP (#3259)
2023-11-27 23:36:25 +00:00
initial_access_suspicious_activity_reported_by_okta_user.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
lateral_movement_multiple_sessions_for_single_user.toml
[New Rule] Threshold Detections for Okta User Sessions and Client Addresses (#3263)
2023-11-28 00:07:58 +00:00
okta_threatinsight_threat_suspected_promotion.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_administrator_privileges_assigned_to_okta_group.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_administrator_role_assigned_to_okta_user.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_attempt_to_create_okta_api_token.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_mfa_deactivation_with_no_reactivation.toml
[Rule Tuning] Adjust Attempt to Deactivate MFA for an Okta User Account Okta Rule (#3345)
2023-12-18 14:19:17 +00:00
persistence_new_idp_successfully_added_by_admin.toml
adding new rule 'New Okta Identity Provider (IdP) Added by Admin' (#3258)
2023-11-27 23:11:58 +00:00
persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml
[Rule Tuning] Bump Minimum Stacks for AWS and Okta for Version Control (#3221)
2023-10-24 16:59:04 +00:00
persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml
[New Rule] Adding Detection for Stolen Credentials Used to Login to Okta Account After MFA Reset (#3265)
2023-12-12 15:37:32 +00:00