IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Multiple Okta Users with the Same Device Token Hash New Okta Authentication Behavior Detected »

› ›

Multiple Okta Client Addresses for a Single User Session

edit

Multiple Okta Client Addresses for a Single User Session

edit

Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user’s Okta account and is using it to access the organization’s resources.

Rule type: threshold

Rule indices:

filebeat-*
logs-okta*

Severity: medium

Risk score: 47

Runs every: 60m

Searches indices from: now-30m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Use Case: Identity and Access Audit
Data Source: Okta
Tactic: Initial Access

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Rule query

edit

event.dataset:okta.system
    and okta.authentication_context.external_session_id:* and okta.debug_context.debug_data.dt_hash:*
    and not (okta.actor.id: okta* or okta.actor.display_name: okta*)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
Sub-technique:
- Name: Cloud Accounts
- ID: T1078.004
- Reference URL: https://attack.mitre.org/techniques/T1078/004/

« Multiple Okta Users with the Same Device Token Hash New Okta Authentication Behavior Detected »