From 576debf5ec35fe50e13dbf3fd48cbdf111052b94 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 2 Apr 2020 12:31:22 -0600 Subject: [PATCH 1/7] new files for okta story --- detections/okta_failed_sso_attempt.yml | 78 +++++++++++++++++ ...tiple_users_with_auth_failures_from_ip.yml | 84 +++++++++++++++++++ detections/okta_user_lockouts.yml | 84 +++++++++++++++++++ .../okta_user_logins_from_multiple_cities.yml | 84 +++++++++++++++++++ investigations/get_okta_activity_by_app.yml | 34 ++++++++ investigations/get_okta_activity_by_ip.yml | 34 ++++++++ investigations/get_okta_user_activity.yml | 34 ++++++++ stories/okta_story.yml | 81 ++++++++++++++++++ 8 files changed, 513 insertions(+) create mode 100644 detections/okta_failed_sso_attempt.yml create mode 100644 detections/okta_multiple_users_with_auth_failures_from_ip.yml create mode 100644 detections/okta_user_lockouts.yml create mode 100644 detections/okta_user_logins_from_multiple_cities.yml create mode 100644 investigations/get_okta_activity_by_app.yml create mode 100644 investigations/get_okta_activity_by_ip.yml create mode 100644 investigations/get_okta_user_activity.yml create mode 100644 stories/okta_story.yml diff --git a/detections/okta_failed_sso_attempt.yml b/detections/okta_failed_sso_attempt.yml new file mode 100644 index 0000000000..6a1a3f0e30 --- /dev/null +++ b/detections/okta_failed_sso_attempt.yml @@ -0,0 +1,78 @@ +asset_type: Infrastructure +confidence: High +creation_date: '2020-04-01' +data_metadata: + data_eventtypes: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: Detect failed Okta SSO events +detect: + splunk: + correlation_rule: + notable: + nes_fields: user + rule_description: Okta user $user$ attempted to access unauthorized app + rule_title: Okta user SSO attempt to unauthorized app + risk: + risk_object: user + risk_object_type: + - user + risk_score: 50 + macros: +# - sysmon - okta? +# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m + search: 'eventtype=okta_log displayMessage="User attempted unauthorized access to app" | stats min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + suppress: + suppress_fields: user + suppress_period: 86400s +eli5: This search looks for events that indicate a user attempted to access an app they did not have permissions to access. This could indicate attempts to access prohibited applications. +entities: + - user +how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' +id: 371a6545-2618-4032-ad84-93386b8698c5 +#investigations: + - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad + name: Investigate Previous Unseen User + type: splunk + - id: 097e8030-8662-4254-a735-bf0bdda696e3 + name: Investigate Failed Logins for Multiple Destinations + type: splunk + - id: ed3fff45-cba6-4990-983f-6fac72bee659 + name: Investigate Pass the Hash Attempts + type: splunk + - id: 990007ad-d798-4b29-ab2f-f0034144c937 + name: Investigate Pass the Ticket Attempts + type: splunk +known_false_positives: There may be a faulty config preventing legitmate users from accessing apps they should have access to. +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +mappings: + cis20: + - CIS 16 + mitre_attack: + - Valid Credentials + mitre_technique_id: + - T1078 + nist: + - DE.CM +modification_date: '2020-04-01' +name: Okta failed SSO attempts +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +#references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +security_domain: access +spec_version: 2 +type: splunk +version: "1" diff --git a/detections/okta_multiple_users_with_auth_failures_from_ip.yml b/detections/okta_multiple_users_with_auth_failures_from_ip.yml new file mode 100644 index 0000000000..b42ff89e1d --- /dev/null +++ b/detections/okta_multiple_users_with_auth_failures_from_ip.yml @@ -0,0 +1,84 @@ +asset_type: Infrastructure +confidence: High +creation_date: '2020-04-01' +data_metadata: + data_eventtypes: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. +detect: + splunk: + correlation_rule: +# notable: +# nes_fields: user +# rule_description: User $user$ logged into Okta from different states +# rule_title: Okta user login from different cities + risk: + risk_object: system + risk_object_type: + - system + risk_score: 50 + macros: +# - sysmon - okta? +# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m +# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 + | rename Computer as dest + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `unsigned_image_loaded_by_LSASS_filter`' + search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5' + suppress: + suppress_fields: src_ip + suppress_period: 86400s +eli5: This search detects instances when there are more than 5 distinct users failing Okta logins due to invalid credentails from the same IP address. This may be indicative of attack techniques such as credential stuffing or password spraying, where an attacker attempts to login using common or found passwords and attempts to authenticate with them. +entities: + - src_ip +how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' +id: 19cba45f-cad3-4032-8911-0c09e0444552 +#investigations: + - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad + name: Investigate Previous Unseen User + type: splunk + - id: 097e8030-8662-4254-a735-bf0bdda696e3 + name: Investigate Failed Logins for Multiple Destinations + type: splunk + - id: ed3fff45-cba6-4990-983f-6fac72bee659 + name: Investigate Pass the Hash Attempts + type: splunk + - id: 990007ad-d798-4b29-ab2f-f0034144c937 + name: Investigate Pass the Ticket Attempts + type: splunk +known_false_positives: A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +mappings: +# cis20: + - CIS 8 + - CIS 16 + mitre_attack: + - Valid Credentials + mitre_technique_id: + - T1078 +# nist: + - DE.CM +modification_date: '2020-04-01' +name: Multiple Okta users with invalid credentails from the same IP +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +#references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +security_domain: access +spec_version: 2 +type: splunk +version: "1" diff --git a/detections/okta_user_lockouts.yml b/detections/okta_user_lockouts.yml new file mode 100644 index 0000000000..f7c4ad87d1 --- /dev/null +++ b/detections/okta_user_lockouts.yml @@ -0,0 +1,84 @@ +asset_type: Infrastructure +confidence: High +creation_date: '2020-04-01' +data_metadata: + data_eventtypes: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: Detect Okta user lockout events +detect: + splunk: + correlation_rule: +# notable: +# nes_fields: user +# rule_description: User $user$ logged into Okta from different states +# rule_title: Okta user login from different cities + risk: + risk_object: user + risk_object_type: + - user + risk_score: 50 + macros: +# - sysmon - okta? +# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + schedule: + cron_schedule: 0 * * * * + earliest_time: -70m@m + latest_time: -10m@m +# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 + | rename Computer as dest + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `unsigned_image_loaded_by_LSASS_filter`' + search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip' + suppress: + suppress_fields: user + suppress_period: 86400s +eli5: This search detects when a user exceeds the maximum configured Okta login attempts and the account is subsequently locked out. This is often indicative of brtue force attempts against a user account. +entities: + - user +how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' +id: 19cba45f-cad3-4032-8911-0c09e0444552 +#investigations: + - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad + name: Investigate Previous Unseen User + type: splunk + - id: 097e8030-8662-4254-a735-bf0bdda696e3 + name: Investigate Failed Logins for Multiple Destinations + type: splunk + - id: ed3fff45-cba6-4990-983f-6fac72bee659 + name: Investigate Pass the Hash Attempts + type: splunk + - id: 990007ad-d798-4b29-ab2f-f0034144c937 + name: Investigate Pass the Ticket Attempts + type: splunk +known_false_positives: None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor. +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +mappings: +# cis20: + - CIS 8 + - CIS 16 + mitre_attack: + - Valid Credentials + mitre_technique_id: + - T1078 +# nist: + - DE.CM +modification_date: '2020-04-01' +name: Okta account lockout events +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +#references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +security_domain: access +spec_version: 2 +type: splunk +version: "1" diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/okta_user_logins_from_multiple_cities.yml new file mode 100644 index 0000000000..e8646a9519 --- /dev/null +++ b/detections/okta_user_logins_from_multiple_cities.yml @@ -0,0 +1,84 @@ +asset_type: Infrastructure +confidence: High +creation_date: '2020-04-01' +data_metadata: + data_eventtypes: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: This search detects logins from the same user from different states in a 24 hour period. +detect: + splunk: + correlation_rule: +# notable: +# nes_fields: user +# rule_description: User $user$ logged into Okta from different states +# rule_title: Okta user login from different cities + risk: + risk_object: user + risk_object_type: + - system + risk_score: 50 + macros: +# - sysmon - okta? +# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + schedule: + cron_schedule: 0 * * * * + earliest_time: -24h@h + latest_time: -5m@m +# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 + | rename Computer as dest + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `unsigned_image_loaded_by_LSASS_filter`' + search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search locations > 1' + suppress: + suppress_fields: user + suppress_period: 86400s +eli5: This search detects users logging in from multiple states in the last 24 hours. This can be indicative of an attacker using compromised credentials to log in to Okta. The efficacy of this search is highly dependant on the mobility of the users using Okta. It is particularly useful in situations where users should explicitly *not* be travelling, such as during the COVID-19 pandemic. +entities: + - user +how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' +id: 56ef054c-76ef-45f9-af4a-a634695dcd65 +#investigations: + - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad + name: Investigate Previous Unseen User + type: splunk + - id: 097e8030-8662-4254-a735-bf0bdda696e3 + name: Investigate Failed Logins for Multiple Destinations + type: splunk + - id: ed3fff45-cba6-4990-983f-6fac72bee659 + name: Investigate Pass the Hash Attempts + type: splunk + - id: 990007ad-d798-4b29-ab2f-f0034144c937 + name: Investigate Pass the Ticket Attempts + type: splunk +known_false_positives: Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +mappings: +# cis20: + - CIS 8 + - CIS 16 + mitre_attack: + - Valid Credentials + mitre_technique_id: + - T1078 +# nist: + - DE.CM +modification_date: '2020-04-01' +name: Okta user logins from multiple cities +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +#references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +security_domain: access +spec_version: 2 +type: splunk +version: "1" diff --git a/investigations/get_okta_activity_by_app.yml b/investigations/get_okta_activity_by_app.yml new file mode 100644 index 0000000000..3cc1ea16e9 --- /dev/null +++ b/investigations/get_okta_activity_by_app.yml @@ -0,0 +1,34 @@ +creation_date: '2020-04-02' +data_metadata: + eventtype: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: This search returns all okta events associated with a specific app +entities: + - app +how_to_implement: You must be ingesting Okta logs +id: 420eb1b8-2992-45d1-80cf-0b1b2759524d +investigate: + splunk: + fields_required: + - app + schedule: + earliest_time: "86400" + latest_time: "14400" + search: 'eventtype=okta_log app={app} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +modification_date: '2020-04-02' +name: Investigate Okta Activity by app +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +spec_version: 2 +type: splunk +version: '1.0' diff --git a/investigations/get_okta_activity_by_ip.yml b/investigations/get_okta_activity_by_ip.yml new file mode 100644 index 0000000000..fa3e729185 --- /dev/null +++ b/investigations/get_okta_activity_by_ip.yml @@ -0,0 +1,34 @@ +creation_date: '2020-04-02' +data_metadata: + eventtype: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: This search returns all okta events from a specific IP address. +entities: + - src_ip +how_to_implement: You must be ingesting Okta logs +id: 56aae066-d619-477c-93e3-3fb83b2d23c3 +investigate: + splunk: + fields_required: + - user + schedule: + earliest_time: "86400" + latest_time: "14400" + search: 'eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +modification_date: '2020-04-02' +name: Investigate Okta Activity by IP address +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +spec_version: 2 +type: splunk +version: '1.0' diff --git a/investigations/get_okta_user_activity.yml b/investigations/get_okta_user_activity.yml new file mode 100644 index 0000000000..05ec99314d --- /dev/null +++ b/investigations/get_okta_user_activity.yml @@ -0,0 +1,34 @@ +creation_date: '2020-04-02' +data_metadata: + eventtype: + - okta_log + data_source: + - Okta + providing_technologies: + - Okta +description: This search returns all okta events by a specific user +entities: + - user +how_to_implement: You must be ingesting Okta logs +id: 24ff145d-4d16-420a-b047-480f2a51c403 +investigate: + splunk: + fields_required: + - user + schedule: + earliest_time: "86400" + latest_time: "14400" + search: 'eventtype=okta_log user={user} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +modification_date: '2020-04-02' +name: Investigate User Activities In Okta +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +spec_version: 2 +type: splunk +version: '1.0' diff --git a/stories/okta_story.yml b/stories/okta_story.yml new file mode 100644 index 0000000000..436d862586 --- /dev/null +++ b/stories/okta_story.yml @@ -0,0 +1,81 @@ +category: + - Adversary Tactics +channel: ESCU +creation_date: '2020-04-02' +description: ###Need to update for okta####Uncover activity consistent with credential dumping, a technique wherein + attackers compromise systems and attempt to obtain and exfiltrate passwords. The + threat actors use these pilfered credentials to further escalate privileges and + spread throughout a target environment. The included searches in this Analytic Story + are designed to identify attempts to credential dumping. +detections: ## Update + - detection_id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 + name: Access LSASS Memory for Dump Creation + type: splunk + - detection_id: 67d4dbef-9564-4699-8da8-03a151529edc + name: Create Remote Thread into LSASS + type: splunk + - detection_id: 2c365e57-4414-4540-8dc0-73ab10729996 + name: Detect Credential Dumping through LSASS access + type: splunk + - detection_id: 56ef054c-76ef-45f9-af4a-a634695dcd65 + name: Unsigned Image Loaded by LSASS + type: splunk + - detection_id: 14038953-e5f2-4daf-acff-5452062baf03 + name: Attempted Credential Dump From Registry via Reg.exe + type: splunk + - detection_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 + name: Detect Mimikatz Using Loaded Images + type: splunk + - detection_id: c2590137-0b08-4985-9ec5-6ae23d92f63d + name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass + type: splunk + - detection_id: eb120f5f-b879-4a63-97c1-93352b5df844 + name: Creation of Shadow Copy + type: splunk + - detection_id: 2ed8b538-d284-449a-be1d-82ad1dbd186b + name: Creation of Shadow Copy with wmic and powershell + type: splunk + - detection_id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b + name: Credential Dumping via Copy Command from Shadowcopy + type: splunk + - detection_id: c5eac648-fae0-4263-91a6-773df1f4c903 + name: Credential Dumping via Symlink to Shadowcopy + type: splunk + - detection_id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 + name: Dump LSASS via comsvcs DLL + type: splunk +id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a +maintainers: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez + - company: Splunk + email: pbareiss@splunk.com + name: Patrick Bareiss +modification_date: '2020-04-02' +name: Suspicious Okta Activity +narrative: ###Needs Updating##'Credential dumping—gathering credentials from a target system, often + hashed or encrypted—is a common attack technique. Even though the credentials + may not be in plain text, an attacker can still exfiltrate the data and set to cracking + it offline, on their own systems. The threat actors target a variety of sources + to extract them, including the Security Accounts Manager (SAM), Local Security Authority + (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ + + Once attackers obtain valid credentials, they use them to move throughout a target + network with ease, discovering new systems and identifying assets of interest. Credentials + obtained in this manner typically include those of privileged users, which may provide + access to more sensitive information and system operations.\ + + The detection searches in this Analytic Story monitor access to the Local Security + Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential + dumping and some other techniques for credential dumping.' +original_authors: + - company: Splunk + email: rvaldez@splunk.com + name: Rico Valdez +references:#### + - https://attack.mitre.org/wiki/Technique/T1003 + - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html +spec_version: 2 +usecase: Security Monitoring +version: '1.0' From 4febee85d880048815acc12aa64f094fb03de2c1 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 2 Apr 2020 13:17:04 -0600 Subject: [PATCH 2/7] Updates to detection files - still need macros --- detections/okta_failed_sso_attempt.yml | 16 +++------ ...tiple_users_with_auth_failures_from_ip.yml | 35 +++++-------------- detections/okta_user_lockouts.yml | 35 +++++-------------- .../okta_user_logins_from_multiple_cities.yml | 35 +++++-------------- investigations/get_okta_activity_by_ip.yml | 2 +- 5 files changed, 33 insertions(+), 90 deletions(-) diff --git a/detections/okta_failed_sso_attempt.yml b/detections/okta_failed_sso_attempt.yml index 6a1a3f0e30..fc7f058963 100644 --- a/detections/okta_failed_sso_attempt.yml +++ b/detections/okta_failed_sso_attempt.yml @@ -37,18 +37,12 @@ entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' id: 371a6545-2618-4032-ad84-93386b8698c5 -#investigations: - - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad - name: Investigate Previous Unseen User +investigations: + - id: 24ff145d-4d16-420a-b047-480f2a51c403 + name: Investigate User Activities In Okta type: splunk - - id: 097e8030-8662-4254-a735-bf0bdda696e3 - name: Investigate Failed Logins for Multiple Destinations - type: splunk - - id: ed3fff45-cba6-4990-983f-6fac72bee659 - name: Investigate Pass the Hash Attempts - type: splunk - - id: 990007ad-d798-4b29-ab2f-f0034144c937 - name: Investigate Pass the Ticket Attempts + - id: 420eb1b8-2992-45d1-80cf-0b1b2759524d + name: Investigate Okta Activity by App type: splunk known_false_positives: There may be a faulty config preventing legitmate users from accessing apps they should have access to. maintainers: diff --git a/detections/okta_multiple_users_with_auth_failures_from_ip.yml b/detections/okta_multiple_users_with_auth_failures_from_ip.yml index b42ff89e1d..6bd4c276ab 100644 --- a/detections/okta_multiple_users_with_auth_failures_from_ip.yml +++ b/detections/okta_multiple_users_with_auth_failures_from_ip.yml @@ -12,10 +12,10 @@ description: This search detects Okta login failures due to bad credentials for detect: splunk: correlation_rule: -# notable: -# nes_fields: user -# rule_description: User $user$ logged into Okta from different states -# rule_title: Okta user login from different cities + notable: + nes_fields: src_ip + rule_description: Multiple Users Failing Authenticaiton From $src_ip$ + rule_title: Multiple Okta Users With Authentication Failures From a Single IP risk: risk_object: system risk_object_type: @@ -28,11 +28,6 @@ detect: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m -# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 - | rename Computer as dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `unsigned_image_loaded_by_LSASS_filter`' search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5' suppress: suppress_fields: src_ip @@ -42,18 +37,9 @@ entities: - src_ip how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' id: 19cba45f-cad3-4032-8911-0c09e0444552 -#investigations: - - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad - name: Investigate Previous Unseen User - type: splunk - - id: 097e8030-8662-4254-a735-bf0bdda696e3 - name: Investigate Failed Logins for Multiple Destinations - type: splunk - - id: ed3fff45-cba6-4990-983f-6fac72bee659 - name: Investigate Pass the Hash Attempts - type: splunk - - id: 990007ad-d798-4b29-ab2f-f0034144c937 - name: Investigate Pass the Ticket Attempts +investigations: + - id: 56aae066-d619-477c-93e3-3fb83b2d23c3 + name: Investigate Okta Activity by IP Address type: splunk known_false_positives: A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro XXXXXXXXXXXXX to raise the threshold or except specific IP adresses from triggering this search. maintainers: @@ -61,14 +47,13 @@ maintainers: email: rvaldez@splunk.com name: Rico Valdez mappings: -# cis20: - - CIS 8 + cis20: - CIS 16 mitre_attack: - Valid Credentials mitre_technique_id: - T1078 -# nist: + nist: - DE.CM modification_date: '2020-04-01' name: Multiple Okta users with invalid credentails from the same IP @@ -76,8 +61,6 @@ original_authors: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez -#references: - - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf security_domain: access spec_version: 2 type: splunk diff --git a/detections/okta_user_lockouts.yml b/detections/okta_user_lockouts.yml index f7c4ad87d1..b54815edc2 100644 --- a/detections/okta_user_lockouts.yml +++ b/detections/okta_user_lockouts.yml @@ -12,10 +12,10 @@ description: Detect Okta user lockout events detect: splunk: correlation_rule: -# notable: -# nes_fields: user -# rule_description: User $user$ logged into Okta from different states -# rule_title: Okta user login from different cities + notable: + nes_fields: user + rule_description: User $user$ locked out of Okta - too many attempts + rule_title: Okta user lockout events risk: risk_object: user risk_object_type: @@ -23,16 +23,11 @@ detect: risk_score: 50 macros: # - sysmon - okta? -# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter +# - unsigned_image_loaded_by_LSASS_filter - okta_user_lockout_events_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m -# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 - | rename Computer as dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `unsigned_image_loaded_by_LSASS_filter`' search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip' suppress: suppress_fields: user @@ -43,17 +38,8 @@ entities: how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' id: 19cba45f-cad3-4032-8911-0c09e0444552 #investigations: - - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad - name: Investigate Previous Unseen User - type: splunk - - id: 097e8030-8662-4254-a735-bf0bdda696e3 - name: Investigate Failed Logins for Multiple Destinations - type: splunk - - id: ed3fff45-cba6-4990-983f-6fac72bee659 - name: Investigate Pass the Hash Attempts - type: splunk - - id: 990007ad-d798-4b29-ab2f-f0034144c937 - name: Investigate Pass the Ticket Attempts + - id: 24ff145d-4d16-420a-b047-480f2a51c403 + name: Investigate User Activity In Okta type: splunk known_false_positives: None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor. maintainers: @@ -61,14 +47,13 @@ maintainers: email: rvaldez@splunk.com name: Rico Valdez mappings: -# cis20: - - CIS 8 + cis20: - CIS 16 mitre_attack: - Valid Credentials mitre_technique_id: - T1078 -# nist: + nist: - DE.CM modification_date: '2020-04-01' name: Okta account lockout events @@ -76,8 +61,6 @@ original_authors: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez -#references: - - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf security_domain: access spec_version: 2 type: splunk diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/okta_user_logins_from_multiple_cities.yml index e8646a9519..1a280d115f 100644 --- a/detections/okta_user_logins_from_multiple_cities.yml +++ b/detections/okta_user_logins_from_multiple_cities.yml @@ -12,10 +12,10 @@ description: This search detects logins from the same user from different states detect: splunk: correlation_rule: -# notable: -# nes_fields: user -# rule_description: User $user$ logged into Okta from different states -# rule_title: Okta user login from different cities + notable: + nes_fields: user + rule_description: User $user$ logged into Okta from different cities + rule_title: Okta user login from different cities risk: risk_object: user risk_object_type: @@ -28,11 +28,6 @@ detect: cron_schedule: 0 * * * * earliest_time: -24h@h latest_time: -5m@m -# search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false - | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 - | rename Computer as dest - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `unsigned_image_loaded_by_LSASS_filter`' search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search locations > 1' suppress: suppress_fields: user @@ -42,18 +37,9 @@ entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' id: 56ef054c-76ef-45f9-af4a-a634695dcd65 -#investigations: - - id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad - name: Investigate Previous Unseen User - type: splunk - - id: 097e8030-8662-4254-a735-bf0bdda696e3 - name: Investigate Failed Logins for Multiple Destinations - type: splunk - - id: ed3fff45-cba6-4990-983f-6fac72bee659 - name: Investigate Pass the Hash Attempts - type: splunk - - id: 990007ad-d798-4b29-ab2f-f0034144c937 - name: Investigate Pass the Ticket Attempts +investigations: + - id: 24ff145d-4d16-420a-b047-480f2a51c403 + name: Investigate User Activity In Okta type: splunk known_false_positives: Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint. maintainers: @@ -61,14 +47,13 @@ maintainers: email: rvaldez@splunk.com name: Rico Valdez mappings: -# cis20: - - CIS 8 + cis20: - CIS 16 mitre_attack: - Valid Credentials mitre_technique_id: - T1078 -# nist: + nist: - DE.CM modification_date: '2020-04-01' name: Okta user logins from multiple cities @@ -76,8 +61,6 @@ original_authors: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez -#references: - - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf security_domain: access spec_version: 2 type: splunk diff --git a/investigations/get_okta_activity_by_ip.yml b/investigations/get_okta_activity_by_ip.yml index fa3e729185..d99a0baa32 100644 --- a/investigations/get_okta_activity_by_ip.yml +++ b/investigations/get_okta_activity_by_ip.yml @@ -24,7 +24,7 @@ maintainers: email: rvaldez@splunk.com name: Rico Valdez modification_date: '2020-04-02' -name: Investigate Okta Activity by IP address +name: Investigate Okta Activity by IP Address original_authors: - company: Splunk email: rvaldez@splunk.com From 26446e099f5051fbb363106e7db85051dc7b4268 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 2 Apr 2020 13:36:55 -0600 Subject: [PATCH 3/7] some naming tweaks to detections, and detctions in stories. Need text for story --- detections/okta_failed_sso_attempt.yml | 2 +- ...tiple_users_with_auth_failures_from_ip.yml | 2 +- detections/okta_user_lockouts.yml | 4 +- .../okta_user_logins_from_multiple_cities.yml | 4 +- ...ory.yml => suspicious_okta_activities.yml} | 47 ++++--------------- 5 files changed, 16 insertions(+), 43 deletions(-) rename stories/{okta_story.yml => suspicious_okta_activities.yml} (57%) diff --git a/detections/okta_failed_sso_attempt.yml b/detections/okta_failed_sso_attempt.yml index fc7f058963..396a27e3b4 100644 --- a/detections/okta_failed_sso_attempt.yml +++ b/detections/okta_failed_sso_attempt.yml @@ -59,7 +59,7 @@ mappings: nist: - DE.CM modification_date: '2020-04-01' -name: Okta failed SSO attempts +name: Okta Failed SSO Attempts original_authors: - company: Splunk email: rvaldez@splunk.com diff --git a/detections/okta_multiple_users_with_auth_failures_from_ip.yml b/detections/okta_multiple_users_with_auth_failures_from_ip.yml index 6bd4c276ab..2f1c407663 100644 --- a/detections/okta_multiple_users_with_auth_failures_from_ip.yml +++ b/detections/okta_multiple_users_with_auth_failures_from_ip.yml @@ -56,7 +56,7 @@ mappings: nist: - DE.CM modification_date: '2020-04-01' -name: Multiple Okta users with invalid credentails from the same IP +name: Multiple Okta Users With Invalid Credentails From The Same IP original_authors: - company: Splunk email: rvaldez@splunk.com diff --git a/detections/okta_user_lockouts.yml b/detections/okta_user_lockouts.yml index b54815edc2..f021e92e99 100644 --- a/detections/okta_user_lockouts.yml +++ b/detections/okta_user_lockouts.yml @@ -36,7 +36,7 @@ eli5: This search detects when a user exceeds the maximum configured Okta login entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' -id: 19cba45f-cad3-4032-8911-0c09e0444552 +id: 62b70968-a0a5-4724-8ac4-67871e6f544d #investigations: - id: 24ff145d-4d16-420a-b047-480f2a51c403 name: Investigate User Activity In Okta @@ -56,7 +56,7 @@ mappings: nist: - DE.CM modification_date: '2020-04-01' -name: Okta account lockout events +name: Okta Account Lockout Events original_authors: - company: Splunk email: rvaldez@splunk.com diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/okta_user_logins_from_multiple_cities.yml index 1a280d115f..f3cbe1144e 100644 --- a/detections/okta_user_logins_from_multiple_cities.yml +++ b/detections/okta_user_logins_from_multiple_cities.yml @@ -36,7 +36,7 @@ eli5: This search detects users logging in from multiple states in the last 24 h entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' -id: 56ef054c-76ef-45f9-af4a-a634695dcd65 +id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8 investigations: - id: 24ff145d-4d16-420a-b047-480f2a51c403 name: Investigate User Activity In Okta @@ -56,7 +56,7 @@ mappings: nist: - DE.CM modification_date: '2020-04-01' -name: Okta user logins from multiple cities +name: Okta User Logins From Multiple Cities original_authors: - company: Splunk email: rvaldez@splunk.com diff --git a/stories/okta_story.yml b/stories/suspicious_okta_activities.yml similarity index 57% rename from stories/okta_story.yml rename to stories/suspicious_okta_activities.yml index 436d862586..84bacd58e1 100644 --- a/stories/okta_story.yml +++ b/stories/suspicious_okta_activities.yml @@ -7,51 +7,24 @@ description: ###Need to update for okta####Uncover activity consistent with cred threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. -detections: ## Update - - detection_id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 - name: Access LSASS Memory for Dump Creation +detections: + - detection_id: 371a6545-2618-4032-ad84-93386b8698c5 + name: Okta Failed SSO Attempts type: splunk - - detection_id: 67d4dbef-9564-4699-8da8-03a151529edc - name: Create Remote Thread into LSASS + - detection_id: 19cba45f-cad3-4032-8911-0c09e0444552 + name: Multiple Okta Users With Invalid Credentails From The Same IP type: splunk - - detection_id: 2c365e57-4414-4540-8dc0-73ab10729996 - name: Detect Credential Dumping through LSASS access + - detection_id: 62b70968-a0a5-4724-8ac4-67871e6f544d + name: Okta Account Lockout Events type: splunk - - detection_id: 56ef054c-76ef-45f9-af4a-a634695dcd65 - name: Unsigned Image Loaded by LSASS + - detection_id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8 + name: Okta User Logins From Multiple Cities type: splunk - - detection_id: 14038953-e5f2-4daf-acff-5452062baf03 - name: Attempted Credential Dump From Registry via Reg.exe - type: splunk - - detection_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 - name: Detect Mimikatz Using Loaded Images - type: splunk - - detection_id: c2590137-0b08-4985-9ec5-6ae23d92f63d - name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - type: splunk - - detection_id: eb120f5f-b879-4a63-97c1-93352b5df844 - name: Creation of Shadow Copy - type: splunk - - detection_id: 2ed8b538-d284-449a-be1d-82ad1dbd186b - name: Creation of Shadow Copy with wmic and powershell - type: splunk - - detection_id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b - name: Credential Dumping via Copy Command from Shadowcopy - type: splunk - - detection_id: c5eac648-fae0-4263-91a6-773df1f4c903 - name: Credential Dumping via Symlink to Shadowcopy - type: splunk - - detection_id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 - name: Dump LSASS via comsvcs DLL - type: splunk -id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a +id: 9cbd34af-8f39-4476-a423-bacd126c750b maintainers: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez - - company: Splunk - email: pbareiss@splunk.com - name: Patrick Bareiss modification_date: '2020-04-02' name: Suspicious Okta Activity narrative: ###Needs Updating##'Credential dumping—gathering credentials from a target system, often From 500a21e8cce4adffff80a4141694ffba607db812 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 2 Apr 2020 13:39:29 -0700 Subject: [PATCH 4/7] detection, spec and macroupdates --- detections/okta_failed_sso_attempt.yml | 13 +++++-------- ...ta_multiple_users_with_auth_failures_from_ip.yml | 9 ++++----- detections/okta_user_lockouts.yml | 11 +++++------ .../okta_user_logins_from_multiple_cities.yml | 9 ++++----- macros/okta_failed_sso_attempt_filter.yml | 3 +++ ...iple_users_with_auth_failures_from_ip_filter.yml | 3 +++ macros/okta_user_lockouts_filter.yml | 3 +++ ...okta_user_logins_from_multiple_cities_filter.yml | 3 +++ spec/v2/baselines.spec.json | 3 ++- spec/v2/detections.spec.json | 4 +++- spec/v2/investigations.spec.json | 3 ++- 11 files changed, 37 insertions(+), 27 deletions(-) create mode 100644 macros/okta_failed_sso_attempt_filter.yml create mode 100644 macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml create mode 100644 macros/okta_user_lockouts_filter.yml create mode 100644 macros/okta_user_logins_from_multiple_cities_filter.yml diff --git a/detections/okta_failed_sso_attempt.yml b/detections/okta_failed_sso_attempt.yml index 396a27e3b4..57df64ca52 100644 --- a/detections/okta_failed_sso_attempt.yml +++ b/detections/okta_failed_sso_attempt.yml @@ -1,5 +1,5 @@ asset_type: Infrastructure -confidence: High +confidence: high creation_date: '2020-04-01' data_metadata: data_eventtypes: @@ -22,17 +22,16 @@ detect: - user risk_score: 50 macros: -# - sysmon - okta? -# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + - okta_failed_sso_attempt_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: 'eventtype=okta_log displayMessage="User attempted unauthorized access to app" | stats min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: 'eventtype=okta_log displayMessage="User attempted unauthorized access to app" | stats min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`okta_failed_sso_attempt_filter`' suppress: suppress_fields: user suppress_period: 86400s -eli5: This search looks for events that indicate a user attempted to access an app they did not have permissions to access. This could indicate attempts to access prohibited applications. +eli5: This search looks for events that indicate a user attempted to access an app they did not have permissions to access. This could indicate attempts to access prohibited applications. Please leverage the `okta_failed_sso_attempt_filter` macro to filter out false positives entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' @@ -53,7 +52,7 @@ mappings: cis20: - CIS 16 mitre_attack: - - Valid Credentials + - Valid Accounts mitre_technique_id: - T1078 nist: @@ -64,8 +63,6 @@ original_authors: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez -#references: - - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf security_domain: access spec_version: 2 type: splunk diff --git a/detections/okta_multiple_users_with_auth_failures_from_ip.yml b/detections/okta_multiple_users_with_auth_failures_from_ip.yml index 2f1c407663..854e39ddaf 100644 --- a/detections/okta_multiple_users_with_auth_failures_from_ip.yml +++ b/detections/okta_multiple_users_with_auth_failures_from_ip.yml @@ -1,5 +1,5 @@ asset_type: Infrastructure -confidence: High +confidence: high creation_date: '2020-04-01' data_metadata: data_eventtypes: @@ -22,13 +22,12 @@ detect: - system risk_score: 50 macros: -# - sysmon - okta? -# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + - okta_multiple_users_with_auth_failures_from_ip_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5' + search: 'eventtype=okta_log outcome.reason=INVALID_CREDENTIALS | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search distinct_users > 5| `okta_multiple_users_with_auth_failures_from_ip_filter`' suppress: suppress_fields: src_ip suppress_period: 86400s @@ -50,7 +49,7 @@ mappings: cis20: - CIS 16 mitre_attack: - - Valid Credentials + - Valid Accounts mitre_technique_id: - T1078 nist: diff --git a/detections/okta_user_lockouts.yml b/detections/okta_user_lockouts.yml index f021e92e99..549729a2bf 100644 --- a/detections/okta_user_lockouts.yml +++ b/detections/okta_user_lockouts.yml @@ -1,5 +1,5 @@ asset_type: Infrastructure -confidence: High +confidence: high creation_date: '2020-04-01' data_metadata: data_eventtypes: @@ -22,13 +22,12 @@ detect: - user risk_score: 50 macros: -# - sysmon - okta? -# - unsigned_image_loaded_by_LSASS_filter - okta_user_lockout_events_filter + - okta_user_lockouts_filter schedule: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip' + search: 'eventtype=okta_log displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip |`okta_user_lockouts_filter`' suppress: suppress_fields: user suppress_period: 86400s @@ -37,7 +36,7 @@ entities: - user how_to_implement: 'This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.' id: 62b70968-a0a5-4724-8ac4-67871e6f544d -#investigations: +investigations: - id: 24ff145d-4d16-420a-b047-480f2a51c403 name: Investigate User Activity In Okta type: splunk @@ -50,7 +49,7 @@ mappings: cis20: - CIS 16 mitre_attack: - - Valid Credentials + - Valid Accounts mitre_technique_id: - T1078 nist: diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/okta_user_logins_from_multiple_cities.yml index f3cbe1144e..d2f6af2418 100644 --- a/detections/okta_user_logins_from_multiple_cities.yml +++ b/detections/okta_user_logins_from_multiple_cities.yml @@ -1,5 +1,5 @@ asset_type: Infrastructure -confidence: High +confidence: high creation_date: '2020-04-01' data_metadata: data_eventtypes: @@ -22,13 +22,12 @@ detect: - system risk_score: 50 macros: -# - sysmon - okta? -# - unsigned_image_loaded_by_LSASS_filter - okta_user_logins_from_multiple_cities_filter + - okta_user_logins_from_multiple_cities_filter schedule: cron_schedule: 0 * * * * earliest_time: -24h@h latest_time: -5m@m - search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search locations > 1' + search: 'eventtype=okta_log displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`okta_user_logins_from_multiple_cities_filter`| search locations > 1' suppress: suppress_fields: user suppress_period: 86400s @@ -50,7 +49,7 @@ mappings: cis20: - CIS 16 mitre_attack: - - Valid Credentials + - Valid Accounts mitre_technique_id: - T1078 nist: diff --git a/macros/okta_failed_sso_attempt_filter.yml b/macros/okta_failed_sso_attempt_filter.yml new file mode 100644 index 0000000000..1d62efcfe0 --- /dev/null +++ b/macros/okta_failed_sso_attempt_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: okta_failed_sso_attempt_filter \ No newline at end of file diff --git a/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml b/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml new file mode 100644 index 0000000000..be4ef2b1d3 --- /dev/null +++ b/macros/okta_multiple_users_with_auth_failures_from_ip_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: okta_multiple_users_with_auth_failures_from_ip_filter \ No newline at end of file diff --git a/macros/okta_user_lockouts_filter.yml b/macros/okta_user_lockouts_filter.yml new file mode 100644 index 0000000000..27f4329ce0 --- /dev/null +++ b/macros/okta_user_lockouts_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: okta_user_lockouts_filter \ No newline at end of file diff --git a/macros/okta_user_logins_from_multiple_cities_filter.yml b/macros/okta_user_logins_from_multiple_cities_filter.yml new file mode 100644 index 0000000000..81b8ca5841 --- /dev/null +++ b/macros/okta_user_logins_from_multiple_cities_filter.yml @@ -0,0 +1,3 @@ +definition: search * +description: Update this macro to limit the output results to filter out false positives. +name: okta_user_logins_from_multiple_cities_filter \ No newline at end of file diff --git a/spec/v2/baselines.spec.json b/spec/v2/baselines.spec.json index 1d8d648a5c..b4d1eab4b1 100644 --- a/spec/v2/baselines.spec.json +++ b/spec/v2/baselines.spec.json @@ -273,7 +273,8 @@ "Ziften", "Censys", "Passive Total", - "WHOIS" + "WHOIS", + "Okta" ] }, "minItems": 0, diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 9227102dc4..19b180117a 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -646,7 +646,8 @@ "Sysmon", "Tanium", "Ziften", - "OSquery" + "OSquery", + "Okta" ] }, "minItems": 0, @@ -714,6 +715,7 @@ "items": { "enum": [ "accessKeyId", + "app", "arn", "awsRegion", "bucketName", diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index d94dfc3801..ce9c5987a4 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -206,7 +206,8 @@ "SMTP", "Cuckoo", "VirusTotal", - "DeepSight" + "DeepSight", + "Okta" ] }, "minItems": 0, From ea97a7574dd1cdf701feb8060f225ad360927412 Mon Sep 17 00:00:00 2001 From: Rico Valdez Date: Thu, 2 Apr 2020 15:03:35 -0600 Subject: [PATCH 5/7] updates to story manifest --- stories/suspicious_okta_activities.yml | 46 ++++++++++++++------------ 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/stories/suspicious_okta_activities.yml b/stories/suspicious_okta_activities.yml index 84bacd58e1..014100f76d 100644 --- a/stories/suspicious_okta_activities.yml +++ b/stories/suspicious_okta_activities.yml @@ -2,11 +2,11 @@ category: - Adversary Tactics channel: ESCU creation_date: '2020-04-02' -description: ###Need to update for okta####Uncover activity consistent with credential dumping, a technique wherein - attackers compromise systems and attempt to obtain and exfiltrate passwords. The - threat actors use these pilfered credentials to further escalate privileges and - spread throughout a target environment. The included searches in this Analytic Story - are designed to identify attempts to credential dumping. +description: Monitor your Okta environment for suspicious activities. Due to the Covid + outbreak, many users are migrating over to leverage cloud services more and more. + Okta is a popular tool to manage multiple users and the web-based applications they need + to stay productive. The searches in this story will help monitor your Okta environment for + suspicious activities and associated user behaviors. detections: - detection_id: 371a6545-2618-4032-ad84-93386b8698c5 name: Okta Failed SSO Attempts @@ -27,28 +27,30 @@ maintainers: name: Rico Valdez modification_date: '2020-04-02' name: Suspicious Okta Activity -narrative: ###Needs Updating##'Credential dumping—gathering credentials from a target system, often - hashed or encrypted—is a common attack technique. Even though the credentials - may not be in plain text, an attacker can still exfiltrate the data and set to cracking - it offline, on their own systems. The threat actors target a variety of sources - to extract them, including the Security Accounts Manager (SAM), Local Security Authority - (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ +narrative: Okta is the leading single sign on (SSO) provider, allowing users to authenticate once + to Okta, and from there access a variety of web-based applications. These applications are + assigned to users and allow administrators to centrally manage which users are allowed to + access which applications. It also provides centralized logging to help understand how the + applications are used and by whom. + + While SSO is a major convenience for users, it also provides attackers with an opportunity. + If the attacker can gain access to Okta, they can access a variety of applications. + As such monitoring the environment is important. - Once attackers obtain valid credentials, they use them to move throughout a target - network with ease, discovering new systems and identifying assets of interest. Credentials - obtained in this manner typically include those of privileged users, which may provide - access to more sensitive information and system operations.\ - - The detection searches in this Analytic Story monitor access to the Local Security - Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential - dumping and some other techniques for credential dumping.' + With people moving quickly to adopt web-based applications and ways to manage them, many + are still struggling to understand how best to monitor these environments. This analytic + story provides searches to help monitor this environment, and identify events and activity + that warrant further investigation such as credential stuffing or password spraying attacks, + and users logging in from multiple locations when travel is disallowed. + original_authors: - company: Splunk email: rvaldez@splunk.com name: Rico Valdez -references:#### - - https://attack.mitre.org/wiki/Technique/T1003 - - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html +references: + - https://attack.mitre.org/wiki/Technique/T1078 + - https://owasp.org/www-community/attacks/Credential_stuffing + - https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work spec_version: 2 usecase: Security Monitoring version: '1.0' From a04b31e0381ea87316656e3b1ee5af24d959f875 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 2 Apr 2020 14:18:26 -0700 Subject: [PATCH 6/7] spec update for CI --- spec/v2/investigations.spec.json | 1 + 1 file changed, 1 insertion(+) diff --git a/spec/v2/investigations.spec.json b/spec/v2/investigations.spec.json index ce9c5987a4..bf07e97947 100644 --- a/spec/v2/investigations.spec.json +++ b/spec/v2/investigations.spec.json @@ -235,6 +235,7 @@ "enum": [ "accessKeyId", "arn", + "app", "awsRegion", "bucketName", "City", From 41bfc4c0c7db0fc86b1f20b2d3ba35b0f156d286 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 2 Apr 2020 14:57:43 -0700 Subject: [PATCH 7/7] slim failure --- stories/suspicious_okta_activities.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/stories/suspicious_okta_activities.yml b/stories/suspicious_okta_activities.yml index 014100f76d..fd5ba53fad 100644 --- a/stories/suspicious_okta_activities.yml +++ b/stories/suspicious_okta_activities.yml @@ -31,18 +31,17 @@ narrative: Okta is the leading single sign on (SSO) provider, allowing users to to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the - applications are used and by whom. + applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. - As such monitoring the environment is important. + As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, - and users logging in from multiple locations when travel is disallowed. - + and users logging in from multiple locations when travel is disallowed. original_authors: - company: Splunk email: rvaldez@splunk.com