Multiple Okta Client Addresses for a Single User Session | Elastic Security Solution [8.13]

› › ›

« Multiple Logon Failure from the same Source Address Multiple Okta Sessions Detected for a Single User »

Multiple Okta Client Addresses for a Single User Sessionedit

Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate an attacker has compromised a user’s Okta account and is using it to access the organization’s resources.

Rule type: threshold

Rule indices:

filebeat-*
logs-okta*

Severity: medium

Risk score: 47

Runs every: 60m

Searches indices from: now-30m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Use Case: Identity and Access Audit
Data Source: Okta
Tactic: Initial Access

Version: 2

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guideedit

Setupedit

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule queryedit

event.dataset:okta.system
    and okta.authentication_context.external_session_id:* and okta.debug_context.debug_data.dt_hash:*
    and not (okta.actor.id: okta* or okta.actor.display_name: okta*)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
Sub-technique:
- Name: Cloud Accounts
- ID: T1078.004
- Reference URL: https://attack.mitre.org/techniques/T1078/004/

« Multiple Logon Failure from the same Source Address Multiple Okta Sessions Detected for a Single User »