Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
25 rules
Okta: Unauthorized App Access Attempt Based on System Log Message
Alerts when Okta logs show a user attempted unauthorized access to an app.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium363Free2021-09-12Okta: Detect security.threat.detected events in threat insight
Flags Okta System Log security.threat.detected events indicating a detected potential security threat.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium435Free2021-09-12Okta Policy Rule Updated or Deleted
Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium92Free2021-09-12Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow141Free2021-09-12Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
Flags Okta System Log events when a Network Zone is deactivated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium453Free2021-09-12Okta Sign-On Policy Updated or Rule Deleted
Flags Okta sign-on policy updates and sign-on rule deletions in application policies.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium122Free2021-09-12Okta Application Lifecycle Update or Deletion Events
Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium132Free2021-09-12Okta: Detect API token revocation events
Flags Okta API token revocations using system.api_token.revoke System Log events.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium123Free2021-09-12Okta System API Token Creation Events
Flags Okta API token creation events to support investigation of potential persistence.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium343Free2021-09-12Okta Admin Role Granted to User or Group
Flags Okta privilege grant events that assign Administrator permissions to a user or group.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium102Free2021-09-12