Sunturai
Threat report

www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy

https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1078Valid Accounts
  • T1078.004Cloud Accounts
  • T1110Brute Force
  • T1556Modify Authentication Process
  • T1562Impair Defenses
  • T1562.007Disable or Modify Cloud Firewall
  • T1110.003Password Spraying
  • T1484Domain or Tenant Policy Modification
  • +23 more
Open the original

45 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Okta User Sessions Started from Different GeolocationsMedium
Potentially Successful Okta MFA Bombing via Push NotificationsHigh
Potential Okta MFA Bombing via Push NotificationsHigh
Stolen Credentials Used to Login to Okta Account After MFA ResetHigh
Modification or Removal of an Okta Application Sign-On PolicyMedium
New Okta Identity Provider (IdP) Added by AdminMedium
MFA Deactivation with no Re-Activation for Okta User AccountLow
Attempt to Reset MFA Factors for an Okta User AccountLow
Attempt to Create Okta API TokenMedium
Okta User Assigned Administrator RoleMedium
Administrator Privileges Assigned to an Okta GroupMedium
Multiple Okta Sessions Detected for a Single UserMedium
Suspicious Activity Reported by Okta UserMedium
Okta Sign-In Events via Third-Party IdPMedium
Unauthorized Access to an Okta ApplicationLow
Okta Alerts Following Unusual Proxy AuthenticationHigh
First Occurrence of Okta User Session Started via ProxyMedium
Possible Okta DoS AttackMedium
Attempt to Delete an Okta ApplicationLow
Attempt to Deactivate an Okta ApplicationLow
Attempt to Revoke Okta API TokenLow
High Number of Okta User Password Reset or Unlock AttemptsMedium
Attempt to Modify an Okta Policy RuleLow
Attempt to Modify an Okta PolicyLow
Attempt to Modify an Okta Network ZoneMedium

Showing 25 of 45

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice