Okta FastPass blocks phishing authentication attempts via MFA

Alerts on Okta FastPass MFA failures where the declined reason indicates a known phishing attempt.

FreeReviewedSigma · High · v4

Product: okta
Service: okta
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2023-05-07
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566Phishing
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Okta authentication events where MFA using FastPass is declined with the reason "FastPass declined phishing attempt". Attackers attempting to use known phishing pages are likely to trigger this failure behavior, making it a useful signal for initial access attempts. It relies on Okta System Log telemetry fields including event type, outcome result, and outcome reason.

Reporting behind it

Related detections9 linkedT1566 — drag to rearrange

Malicious Office 365 Email Rule Breach - On Behalf (via office365)

Suspicious AWS Console AiTM Phishing Kit API Endpoints

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Proxy WebDAV MiniRedir Drives Execution from External Shares

Windows WebDAV Temporary File Creation with Suspicious Extensions

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Okta FastPass blocks phishing authentication attempts via MFA

Pivot detection · T1566 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

okta-fastpass-phishing-blocked-mfa-authentication-failure-ee39a9f7

title: Okta FastPass blocks phishing authentication attempts via MFA
id: 5c08e762-946a-49ec-ba53-458b143c353c
status: test
description: This rule identifies Okta authentication events where MFA using FastPass is declined with the reason "FastPass declined phishing attempt". Attackers attempting to use known phishing pages are likely to trigger this failure behavior, making it a useful signal for initial access attempts. It relies on Okta System Log telemetry fields including event type, outcome result, and outcome reason.
references:
  - https://sec.okta.com/fastpassphishingdetection
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_fastpass_phishing_detection.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2023-05-07
modified: 2026-04-27
tags:
  - attack.initial-access
  - attack.t1566
logsource:
  product: okta
  service: okta
detection:
  selection:
    outcome.reason: FastPass declined phishing attempt
    outcome.result: FAILURE
    eventType: user.authentication.auth_via_mfa
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL