Robust protection comes from layers, and many of you are already familiar with the Swiss Cheese Model. Simply stated, even when you're confident in your primary controls, that confidence only grows with each additional layer added. Because who wants to have a defense that’s built around a single slice of sad cheese, wrapped in a pitiful film of plastic? No thanks, we’ll take that sturdy block of Swiss each and every time.

Of course, given how thin most security teams are spread, robust layering is often easier said than done. Not every security team has the luxury of dedicated Detection Engineers to craft, research and develop custom logic to catch threat actor activity, and not every security team has the time and skill to synthesize and recreate our logic in other SIEM platforms. With this in mind, Okta Security recently published a number of our bespoke detections.

“But,” quoth the game show hosts, “ that’s not all!” Today we’re excited to share that Chronicle and Okta have been collaborating to help these detections reach an even wider audience. And this time around, the Chronicle team threw a few extra slices of cheese on top!

Not only did they rewrite these detections for their environment, they also did their own research and wrote additional detections. You can read more about each of them over at Chronicle’s blog. We’ve described them below too.

To channel the words of Oprah, “You get a new detection, and you get a new detection, and you get a new detection!”

Okta Phishing Detection with FastPass Origin Check

Successful MFA After Multiple Failures

Repeated MFA Rejections by User

Suspicious Use of an Okta Session Cookie

Failed Number Challenge

Mismatch Between Source and Response for Verify Push Request

Multiple Failed Users with Invalid Credentials from the same IP

User Reported Suspicious Activity

Multiple Failed Requests to Access Okta Applications

ThreatInsight Alert: Suspected Brute Force

ThreatInsight Alert: Suspected Targeted Brute Force

ThreatInsight Alert: Login Failure with High Unknown Users

ThreatInsight Alert: Suspected Password Spray Attack

Successful Login Evaluated as High Risk

Okta User Account Lockout

New Okta API Token Created

Out of Hours Successful Authentication

User Logins from Multiple Cities

We found this exercise to be fulfilling. Writing YARA-L queries is new to us, but they have been super easy to read and collaborate on. Even if you’re not a Chronicle customer, you might find it valuable to read the detection logic in Chronicle to frame your thinking about how you might go about detecting these types of threats.

What’s next?

Once we’re happy with our detections, phishing resistant factors and other control slices; where should we invest our energy next? I’d suggest considering what an adversary might now need to do for persistence and lateral movement. Perhaps they could socially engineer a new factor, a managed device or even a whole new account?

Best get thinking about how you’d detect:

• User factors added or modified (user.mfa.factor*)

• New users created (user.lifecycle.create)

• Devices added to MDM

• Remote Monitoring and Management tool installation or execution

• VM installation on workstations

• Duplicate hostnames

Gouda luck!

The Defensive Cyber Operations (DCO) team is responsible for detecting and responding to cyber threats that impact Okta or our customers via the Okta platform. Our intelligence-driven capability identifies the adversaries most likely to impact Okta and our customers, and prioritises our defensive capabilities based on the threats most likely to be realised.