Detection: Okta New Device Enrolled on Account

Updated Date: 2024-09-30 ID: bb27cbce-d4de-432c-932f-2e206e9130fb Author: Michael Haag, Mauricio Velazco, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies when a new device is enrolled on an Okta account. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to detect the creation of new device enrollments. This activity is significant as it may indicate a legitimate user setting up a new device or an adversary adding a device to maintain unauthorized access. If confirmed malicious, this could lead to potential account takeover, unauthorized access, and persistent control over the compromised Okta account. Monitoring this behavior is crucial for detecting and mitigating unauthorized access attempts.

1
2| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src All_Changes.action All_Changes.object_category 
3| `drop_dm_object_name("All_Changes")` 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `okta_new_device_enrolled_on_account_filter`

Data Source

Name Platform Sourcetype Source
Okta N/A 'OktaIM2:log' 'Okta'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
okta_new_device_enrolled_on_account_filter search *
okta_new_device_enrolled_on_account_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1098 Account Manipulation Persistence
T1098.005 Device Registration Privilege Escalation
KillChainPhase.EXPLOITAITON
KillChainPhase.INSTALLATION
NistCategory.DE_CM
Cis18Value.CIS_10
HAFNIUM
Lazarus Group
APT29

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).

Known False Positives

It is possible that the user has legitimately added a new device to their account. Please verify this activity.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
A new device was enrolled on an Okta account for user [$user$]. Investigate further to determine if this was authorized. 24 40 60
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset Okta OktaIM2:log
Integration ✅ Passing Dataset Okta OktaIM2:log

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5