A user modified an Okta policy rule

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires: Okta Audit Log
Detection Modules	Identity Threat Module
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Defense Evasion (TA0005) Persistence (TA0003)
ATT&CK Technique	Impair Defenses (T1562) Domain or Tenant Policy Modification (T1484) Modify Authentication Process (T1556)
Severity	Informational

An Okta policy rule was modified by a user, suggesting a potential compromise of the account.

An attacker may attempt to modify an Okta policy rule to weaken an organization's security controls.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Investigate if any other security policies have been changed or removed.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An Okta policy rule was modified by a suspicious user, suggesting a potential compromise of the account.

An attacker may attempt to modify an Okta policy rule to weaken an organization's security controls.

Follow further actions done by the account.
Verify that the configuration change was expected.
Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).
Investigate if any other security policies have been changed or removed.