Okta Failed Login with Password-Like AlternateID Value

Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.

FreeReviewedSigma · High · v4

Product: okta
Service: okta
Author: kelnage (SigmaHQ), DRL 1.1
Published: 2023-04-03
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552Unsecured Credentials
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Okta authentication failures (core.user_auth.login_failed) where the actor.alternateId is present but does not match patterns commonly used for Okta service account IDs or valid email-like usernames. Entering a password into a username/alternate ID field can cause sensitive credentials to be retained in system logs, increasing exposure risk. Detection relies on Okta system log events capturing legacyEventType and actor.alternateId values during failed login attempts.

Reporting behind it

Related detections9 linkedT1552 — drag to rearrange

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

Suspicious Access to IIS machine.config outside the Worker Process Context (via security)

Suspicious Bulk Mail and File Collection via MSGraph Application Access (via m365)

Suspicious Python Executing Script from var root Library Caches on macOS (via process_creation)

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

Suspicious Azure Credential Hunting via MicroBurst Modules

Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner

Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

Okta Failed Login with Password-Like AlternateID Value

Pivot detection · T1552 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

okta-failed-login-where-password-like-alternateid-was-provided-91b76b84

title: Okta Failed Login with Password-Like AlternateID Value
id: 0fb13bd9-3dda-4d8b-8c48-145081590758
status: test
description: This rule flags Okta authentication failures (core.user_auth.login_failed) where the actor.alternateId is present but does not match patterns commonly used for Okta service account IDs or valid email-like usernames. Entering a password into a username/alternate ID field can cause sensitive credentials to be retained in system logs, increasing exposure risk. Detection relies on Okta system log events capturing legacyEventType and actor.alternateId values during failed login attempts.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
  - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_password_in_alternateid_field.yml
author: kelnage, Huntrule Team
date: 2023-04-03
modified: 2026-04-27
tags:
  - attack.credential-access
  - attack.t1552
logsource:
  product: okta
  service: okta
detection:
  selection:
    legacyEventType: core.user_auth.login_failed
  filter_main:
    actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})
  condition: selection and not filter_main
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 91b76b84-8589-47aa-9605-c837583b82a9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL