Attack Chain

1. An attacker gains initial access to an Okta tenant, potentially through compromised credentials or by exploiting a vulnerability.
2. The attacker leverages their access to enumerate existing Identity Providers (IDPs) within the Okta tenant.
3. The attacker creates a new, rogue IDP configured to trust a malicious identity source controlled by the attacker.
4. The attacker modifies an existing IDP to redirect authentication requests to the rogue IDP.
5. A user attempts to authenticate through the modified IDP, unknowingly providing credentials to the attacker's malicious identity source.
6. The attacker captures the user's credentials or Okta session token.
7. The attacker uses the stolen credentials or session token to gain unauthorized access to applications and resources within the Okta tenant.

Impact

Successful modification of Okta IDP lifecycle events can lead to significant security breaches, including unauthorized access to sensitive data and systems. A compromised IDP can allow attackers to bypass authentication mechanisms, potentially affecting all users and applications reliant on the Okta tenant. The impact includes data breaches, financial losses, and reputational damage.

Recommendation

• Deploy the Sigma rule Okta IDP Lifecycle Event Modifications to your SIEM to detect anomalous changes to Okta IDP lifecycle events, and tune it to your environment.
• Investigate any alerts generated by the Sigma rule Okta IDP Lifecycle Event Modifications to determine if the modifications are legitimate administrative actions or potential security breaches.
• Implement multi-factor authentication (MFA) to reduce the risk of unauthorized access through compromised credentials.
• Regularly review Okta audit logs for suspicious activity related to IDP configurations.
• Monitor user agent details from the Okta IDP Lifecycle Event Modifications by User Agent Sigma rule to detect the usage of suspicious or unknown user agents.