Okta Failed Login Where Password-Like AlternateID Was Provided

title: Okta Failed Login Where Password-Like AlternateID Was Provided
id: 0fb13bd9-3dda-4d8b-8c48-145081590758
status: test
description: This rule flags Okta login failures where the account identifier in the alternateId field potentially contains the user’s password, which can lead to sensitive data being retained in logs. The behavior matters because attackers who misuse authentication inputs may inadvertently expose credentials through logging. It relies on Okta system log telemetry for failed authentication events and evaluates alternateId against a pattern intended to exclude values that resemble valid email addresses.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
  - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_password_in_alternateid_field.yml
author: kelnage, Huntrule Team
date: 2023-04-03
modified: 2026-04-27
tags:
  - attack.credential-access
  - attack.t1552
logsource:
  product: okta
  service: okta
detection:
  selection:
    legacyEventType: core.user_auth.login_failed
  filter_main:
    actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})
  condition: selection and not filter_main
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 91b76b84-8589-47aa-9605-c837583b82a9
    type: derived