IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« UAC Bypass via Windows Firewall Snap-In Hijack Uncommon Registry Persistence Change »

› › ›

Unauthorized Access to an Okta Application

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Unauthorized Access to an Okta Application

edit

Identifies unauthorized access attempts to Okta applications.

Rule type: query

Rule indices:

filebeat-*
logs-okta*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

Elastic
Identity
Okta
Continuous Monitoring
SecOps
Identity and Access

Version: 2 (version history)

Added (Elastic Stack release): 7.16.0

Last modified (Elastic Stack release): 8.1.0

Rule authors: Elastic, Austin Songer

Rule license: Elastic License v2

Investigation guide

edit

## Config

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule query

edit

event.dataset:okta.system and
event.action:app.generic.unauth_app_access_attempt

Threat mapping

edit

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/

Rule version history

edit

Version 2 (8.1.0 release)

Formatting only

« UAC Bypass via Windows Firewall Snap-In Hijack Uncommon Registry Persistence Change »