---
title: Okta access plaintext application password via SWA
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Okta access plaintext application
  password via SWA
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Okta access plaintext application password via SWA
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1555-credentials-from-password-stores](https://attack.mitre.org/techniques/T1555) 
## Goal{% #goal %}

Detects access to plaintext application passwords stored by Okta Secure Web Authentication.

## Strategy{% #strategy %}

This rule monitors successful `application.user_membership.show_password` events. It raises severity when a user views several application passwords, accesses a password from a new device, or accesses a password through a network associated with malicious infrastructure or anonymizing proxy services.

## Triage and response{% #triage-and-response %}

- Verify with `{{@usr.email}}` whether viewing the application password was expected and required for their work.
- Review the affected application, the number of passwords viewed, and other password-access events associated with the user.
- Examine the source IP address, device, geographic location, user agent, session, and recent authentication activity for signs of account compromise.
- Treat consumer or mobile carrier ownership of an IP address as context rather than proof that the activity is benign. Commercial residential proxy services can use endpoints on these networks; review the threat intelligence risk and named proxy-service metadata together with the user's device and location.
- Revoke suspicious sessions and rotate exposed application credentials when the activity is unauthorized.