Okta Failed Login with Password-Like AlternateID Value
Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.
- Product
- okta
- Service
- okta
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2023-04-03
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Okta authentication failures (core.user_auth.login_failed) where the actor.alternateId is present but does not match patterns commonly used for Okta service account IDs or valid email-like usernames. Entering a password into a username/alternate ID field can cause sensitive credentials to be retained in system logs, increasing exposure risk. Detection relies on Okta system log events capturing legacyEventType and actor.alternateId values during failed login attempts.
Reporting behind it
- developer.okta.comhttps://developer.okta.com/docs/reference/api/system-log/
- mitiga.iohttps://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
- help.okta.comhttps://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_password_in_alternateid_field.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Okta Failed Login with Password-Like AlternateID Value
id: 0fb13bd9-3dda-4d8b-8c48-145081590758
status: test
description: This rule flags Okta authentication failures (core.user_auth.login_failed) where the actor.alternateId is present but does not match patterns commonly used for Okta service account IDs or valid email-like usernames. Entering a password into a username/alternate ID field can cause sensitive credentials to be retained in system logs, increasing exposure risk. Detection relies on Okta system log events capturing legacyEventType and actor.alternateId values during failed login attempts.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
- https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_password_in_alternateid_field.yml
author: kelnage, Huntrule Team
date: 2023-04-03
modified: 2026-04-27
tags:
- attack.credential-access
- attack.t1552
logsource:
product: okta
service: okta
detection:
selection:
legacyEventType: core.user_auth.login_failed
filter_main:
actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})
condition: selection and not filter_main
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 91b76b84-8589-47aa-9605-c837583b82a9
type: derived