Okta FastPass Phishing Blocked: MFA Authentication Failure

title: "Okta FastPass Phishing Blocked: MFA Authentication Failure"
id: 5c08e762-946a-49ec-ba53-458b143c353c
status: test
description: This rule flags Okta authentication events where MFA using FastPass was declined due to a known phishing attempt. Attackers often rely on credential capture pages, so a FastPass phishing block indicates a malicious login flow was attempted and rejected. The detection relies on Okta system log fields for event type and failure reason, specifically user.authentication.auth_via_mfa with an outcome indicating the phishing attempt was declined.
references:
  - https://sec.okta.com/fastpassphishingdetection
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_fastpass_phishing_detection.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2023-05-07
modified: 2026-04-27
tags:
  - attack.initial-access
  - attack.t1566
logsource:
  product: okta
  service: okta
detection:
  selection:
    outcome.reason: FastPass declined phishing attempt
    outcome.result: FAILURE
    eventType: user.authentication.auth_via_mfa
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e
    type: derived