Okta MFA Factor Deactivation or Reset Detection

Flags Okta events indicating MFA deactivation or reset_all actions by a user or actor.

FreeUnreviewedSigmamediumv1

okta-mfa-factor-deactivation-or-reset-detection-50e068d7

title: Okta MFA Factor Deactivation or Reset Detection
id: aba92d90-6dab-4969-95f2-87158b2ce7e4
status: test
description: This rule identifies Okta System Log events where a user’s MFA factor is deactivated or all MFA factors are reset. Attackers may use MFA deactivation/reset to reduce authentication strength and regain access or impair account protections. It relies on Okta event telemetry matching the specific MFA deactivation and reset event types.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_mfa_reset_or_deactivated.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-21
modified: 2026-04-27
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556.006
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - user.mfa.factor.deactivate
      - user.mfa.factor.reset_all
  condition: selection
falsepositives:
  - If a MFA reset or deactivated was performed by a system administrator.
level: medium
license: DRL-1.1
related:
  - id: 50e068d7-1e6b-4054-87e5-0a592c40c7e0
    type: derived

What it detects

This rule identifies Okta System Log events where a user’s MFA factor is deactivated or all MFA factors are reset. Attackers may use MFA deactivation/reset to reduce authentication strength and regain access or impair account protections. It relies on Okta event telemetry matching the specific MFA deactivation and reset event types.

Known false positives

If a MFA reset or deactivated was performed by a system administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.