A user attempted to bypass Okta MFA

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Okta Audit Log
Detection Modules	Identity Threat Module
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Modify Authentication Process (T1556) Multi-Factor Authentication Request Generation (T1621)
Severity	Low

A user may have attempted to bypass Okta MFA.

An attacker is attempting to gain access to an account secured with MFA.

Contact the user who attempted to bypass MFA and ensure the request was legitimate.
Check if the user successfully authenticated after the event.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Suspicious MFA bypass attempt in Okta.

An attacker is attempting to gain access to an account secured with MFA.

Contact the user who attempted to bypass MFA and ensure the request was legitimate.
Check if the user successfully authenticated after the event.