A user attempted to bypass Okta MFA

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • Okta Audit Log

Detection Modules

Identity Threat Module

Detector Tags

Okta Audit Analytics

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Severity

Low

Description

A user may have attempted to bypass Okta MFA.

Attacker's Goals

An attacker is attempting to gain access to an account secured with MFA.

Investigative actions

  • Contact the user who attempted to bypass MFA and ensure the request was legitimate.
  • Check if the user successfully authenticated after the event.

Variations

A successful bypass of Okta MFA

Synopsis

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Severity

Low

Description

Suspicious MFA bypass attempt in Okta.

Attacker's Goals

An attacker is attempting to gain access to an account secured with MFA.

Investigative actions

  • Contact the user who attempted to bypass MFA and ensure the request was legitimate.
  • Check if the user successfully authenticated after the event.