Okta temporary password granted and MFA reset
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detects an administrator issuing a temporary password followed by the reset of all MFA factors for the Okta user.
Strategy
This rule monitors Okta account recovery and factor administration events. Alerts when both user.account.expire_password and user.mfa.factor.reset_all succeed for the same account.
When an administrator expires a user password, there’s an option to generate a temporary password for the user which can be used by an attacker to login and set their own. When factors are reset, an attacker can also add multi-factor authentication devices. The detailed behavior can represent an account takeover especially when activity occurs from uncommon geo-location or hosting provider IP addresses.
The rule severity is increased if Datadog detects the IP address is associated with a hosting provider.
Triage & Response
- Identify the permissions of the affected user,
{{@target.alternateId}}, including if they have administrator privileges within your Okta instance. - Review internal tickets for evidence this change was associated with a related request.
- Examine the source IP
{{@network.client.ip}}, geo‑location, and associated domain. - If user activity is suspicious, begin your organization’s incident response process and investigate for any account takeovers.
