Okta temporary password granted and MFA reset
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects an administrator issuing a temporary password followed by the reset of all MFA factors for the Okta user.
Strategy
This rule monitors Okta account recovery and factor administration events. Alerts when both user.account.expire_password and user.mfa.factor.reset_all succeed for the same account.
When an administrator expires a user password, there’s an option to generate a temporary password for the user which can be used by an attacker to login and set their own. When factors are reset, an attacker can also add multi-factor authentication devices. The detailed behavior can represent an account takeover especially when activity occurs from uncommon geo-location or hosting provider IP addresses.
The rule severity is increased if Datadog detects the IP address is associated with a hosting provider.
Triage & Response
- Identify the permissions of the affected user,
{{@target.alternateId}}, including if they have administrator privileges within your Okta instance. - Review internal tickets for evidence this change was associated with a related request.
- Examine the source IP
{{@network.client.ip}}, geo‑location, and associated domain. - If user activity is suspicious, begin your organization’s incident response process and investigate for any account takeovers.
