Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects access to plaintext application passwords stored by Okta Secure Web Authentication.

Strategy

This rule monitors successful application.user_membership.show_password events. It raises severity when a user views several application passwords, accesses a password from a new device, or accesses a password through a network associated with malicious infrastructure or anonymizing proxy services.

Triage and response

• Verify with {{@usr.email}} whether viewing the application password was expected and required for their work.
• Review the affected application, the number of passwords viewed, and other password-access events associated with the user.
• Examine the source IP address, device, geographic location, user agent, session, and recent authentication activity for signs of account compromise.
• Treat consumer or mobile carrier ownership of an IP address as context rather than proof that the activity is benign. Commercial residential proxy services can use endpoints on these networks; review the threat intelligence risk and named proxy-service metadata together with the user’s device and location.
• Revoke suspicious sessions and rotate exposed application credentials when the activity is unauthorized.