Okta: Password Health Report endpoint accessed via /reports/password-health/*

Flags requests to Okta Password Health report endpoints (/reports/password-health/*) for threat hunting.

FreeUnreviewedSigmalowv1

okta-password-health-report-endpoint-accessed-via-reports-password-health-0d58814b

title: "Okta: Password Health Report endpoint accessed via /reports/password-health/*"
id: fb4d67d6-b495-4977-9764-1f99bc6aae46
status: test
description: This rule flags any request whose URI contains /reports/password-health/, an endpoint intended for use via the Okta Admin Console UI. Attackers may query these report endpoints to enumerate or assess credential security posture. The detection relies on Okta service telemetry capturing the request URI.
references:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/cloud/okta/okta_password_health_report_query.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-10-25
tags:
  - attack.credential-access
  - detection.threat-hunting
logsource:
  service: okta
  product: okta
detection:
  selection:
    debugContext.debugData.requestUri|contains: /reports/password-health/
  condition: selection
falsepositives:
  - OKTA Admin Activites via Web Console UI.
  - This rule is recommended to be used for threat hunting, especially in the context of OKTA support incident in OCT-2023.
  - This rule can be used to hunt the activity against endpoints like /reports/password-health/async_csv_download_schedule?, which are typically used from Okta Admin Console UI only, without any corresponding admin console login. See reference
level: low
license: DRL-1.1
related:
  - id: 0d58814b-1660-4d31-8c93-d1086ed24cba
    type: derived

What it detects

This rule flags any request whose URI contains /reports/password-health/, an endpoint intended for use via the Okta Admin Console UI. Attackers may query these report endpoints to enumerate or assess credential security posture. The detection relies on Okta service telemetry capturing the request URI.

Known false positives

OKTA Admin Activites via Web Console UI.
This rule is recommended to be used for threat hunting, especially in the context of OKTA support incident in OCT-2023.
This rule can be used to hunt the activity against endpoints like /reports/password-health/async_csv_download_schedule?, which are typically used from Okta Admin Console UI only, without any corresponding admin console login. See reference

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.