Sigma detection rules, expert-reviewed

Suspicious Okta SSO Access to Many Applications in Short Window

This rule detects a single Okta actor authenticating via SSO into six or more distinct application instances within five minutes. A rapid fan-out across many apps is consistent with a hijacked session enumerating available resources rather than normal user behaviour.

Suspicious Okta Application Self-Assignment to All Applications by UNC3944 (via cloud)

This rule detects Okta application membership assignment events used by UNC3944 to grant a controlled identity access to all applications after compromising a SaaS tenant. Broad self-service application assignment expands attacker reach across integrated SaaS platforms and precedes data access and exfiltration.

Possible AiTM Phishing Sign-On Evaluation Denied by Okta FastPass

This rule detects Okta sign-on policy evaluations that are challenged or denied where the network reputation flags a phishing or proxy origin, matching FastPass anti-phishing rejections. In this campaign an adversary-in-the-middle proxy relayed authentication and Okta FastPass declined the phishing attempt during policy evaluation. Clusters of such denials indicate active AiTM targeting of user credentials and session tokens.

Suspicious Okta Sign-On Policy Lifecycle Modification

This rule detects Okta policy lifecycle update or delete events affecting authentication policies. Adversaries who compromise an Okta admin weaken or remove sign-on and MFA policies to keep access, so lifecycle changes to policies warrant review against expected administration.

Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

Alert on Duo successful MFA logins that are attributed to bypass-user codes.

Okta New User Created via user.lifecycle.create Event

Flags Okta events indicating new user account creation via user.lifecycle.create.

Okta admin function access via proxy (requestUri contains admin and isProxy enabled)

Flags Okta requests targeting admin URIs when the event indicates the traffic is proxied.

Okta user.session.start via anonymising proxy service

Identifies Okta user session starts where the session is marked as using an anonymizing proxy.

Okta: End-user Reported Suspicious Activity Account Event Detection

Flags Okta end-user self-submitted reports of potentially suspicious activity on their account.

Okta Admin Console: New admin console activity via policy.evaluate_sign_on heuristics

Alerts when Okta policy evaluation shows POSITIVE debug heuristics for activity targeting the Okta Admin Console.

Okta System Log: New Identity Provider Created via system.idp.lifecycle.create

Alerts on Okta events indicating a new identity provider was created.

Okta FastPass blocks phishing authentication attempts via MFA

Alerts on Okta FastPass MFA failures where the declined reason indicates a known phishing attempt.

Okta Failed Login with Password-Like AlternateID Value

Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.

Okta Admin Role Assignment Created via iam.resourceset.bindings.add

Detects creation of new admin role assignments in Okta when an IAM resource set binding is added.

OneLogin: Detect API user account lock or suspension events

Flags OneLogin API events indicating a user account was locked or suspended.