Single-Factor Authentication - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/single-factor-authentication/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Okta Successful Single Factor Authentication Attempthttps://feed.craftedsignal.io/briefs/2024-01-03-okta-single-factor-auth/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-okta-single-factor-auth/Successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled, potentially indicating account takeover attempts.This brief focuses on detecting successful single-factor authentication attempts against Okta dashboards. The detection logic identifies successful authentication events where "Okta Verify" is not used, suggesting a potential misconfiguration, policy violation, or account takeover attempt. The activity is detected by analyzing Okta logs for successful authentication events. An attacker exploiting this weakness could gain unauthorized access to accounts, leading to data breaches or further exploitation within the environment. The initial detection logic was published in Splunk ES Content as of April 15, 2026. This remains a relevant tactic for initial access and privilege escalation.

Attack Chain

  1. An attacker gains initial access to a valid username/password through credential harvesting or previously compromised credentials. (T1586.003)
  2. The attacker attempts to log into the Okta dashboard using the compromised credentials.
  3. Okta processes the login attempt, and because MFA is either disabled or not enforced for the account, a single-factor authentication is successful.
  4. The Okta logs record the successful authentication event with an eventType of either 'user.authentication.verify' or 'user.authentication.auth_via_mfa', and the targets field not containing "Okta Verify."
  5. The attacker gains access to the Okta dashboard and any applications accessible through Okta.
  6. The attacker leverages their access to enumerate users, groups, and applications within the Okta environment.
  7. The attacker escalates privileges by assigning themselves higher-level roles or adding themselves to privileged groups.
  8. The attacker gains access to sensitive applications and data, potentially leading to data exfiltration or other malicious activities. (T1621)

Impact

A successful single-factor authentication attack can result in unauthorized access to sensitive applications and data. This can lead to data breaches, financial loss, and reputational damage. The number of affected users and the extent of the damage depend on the privileges and access levels associated with the compromised account. Organizations using Okta for identity management are particularly vulnerable. The successful exploitation can bypass existing security controls and create an entry point for more significant attacks.

Recommendation

  • Deploy the Sigma rule Okta Successful Single Factor Authentication to your SIEM and tune for your environment to identify single-factor authentication events.
  • Investigate any alerts generated by the Sigma rule Okta Successful Single Factor Authentication to determine the legitimacy of the authentication attempt.
  • Enforce MFA for all users in the Okta environment to mitigate the risk of account takeover, referencing the Okta documentation on MFA implementation.
  • Review and enforce Okta MFA policies to prevent single-factor authentication (reference: Okta documentation).
  • Monitor Okta logs for suspicious activity, such as unusual login locations or access patterns, using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
]]>mediumadvisoryoktasingle-factor authenticationaccount takeoverAzure AD Successful Single-Factor Authenticationhttps://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-single-factor-auth/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-azure-ad-single-factor-auth/Successful single-factor authentication events against Azure Active Directory are identified using Azure SignInLogs data, which may indicate misconfiguration, policy violation, or potential account takeover leading to data breaches and privilege escalation.This analytic identifies successful single-factor authentication events against Azure Active Directory. It leverages Azure SignInLogs data, specifically focusing on events where single-factor authentication succeeded. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. An attacker gaining unauthorized access to the account, potentially leading to data breaches, privilege escalation, or further exploitation within the environment. Multi-factor authentication (MFA) is a crucial security control, and its absence can significantly increase the risk of account compromise. The analytic focuses on Azure AD events and is designed to detect deviations from expected authentication patterns.

Attack Chain

  1. Initial Access: The attacker gains initial access to a valid username and password through phishing, credential stuffing, or purchasing stolen credentials.
  2. Attempt Authentication: The attacker attempts to authenticate to Azure AD using the compromised credentials, bypassing MFA if it is not enabled or configured correctly.
  3. Single-Factor Authentication Success: Azure AD logs a successful single-factor authentication event, indicating that the attacker has gained access without additional verification.
  4. Reconnaissance: Once authenticated, the attacker performs reconnaissance activities within the Azure AD environment, gathering information about users, groups, and resources.
  5. Privilege Escalation: The attacker attempts to escalate privileges by exploiting misconfigurations or vulnerabilities within Azure AD or related services.
  6. Lateral Movement: The attacker moves laterally to other systems and applications within the organization's environment, leveraging the compromised account's access rights.
  7. Data Exfiltration: The attacker accesses and exfiltrates sensitive data from cloud storage, databases, or applications accessible with the compromised credentials.
  8. Persistence: The attacker establishes persistence by creating new user accounts, modifying existing ones, or deploying malicious applications within Azure AD.

Impact

A successful single-factor authentication attack can lead to significant damage, including unauthorized access to sensitive data, privilege escalation, and lateral movement within the organization's cloud environment. The absence of MFA makes accounts vulnerable to credential-based attacks. The impact could include data breaches, financial loss, and reputational damage. Many organizations now require this as part of compliance frameworks.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect successful single-factor authentication events in Azure AD logs (Azure Active Directory, azure_monitor_aad).
  • Review and enforce multi-factor authentication (MFA) policies for all users and applications in Azure AD to prevent unauthorized access (https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks*).
  • Investigate any detected successful single-factor authentication events to determine if they are legitimate or indicative of malicious activity (Azure Active Directory, azure_monitor_aad).
  • Monitor user activity for signs of reconnaissance, privilege escalation, and lateral movement following a successful single-factor authentication event (Azure Active Directory, azure_monitor_aad).
]]>mediumadvisoryazureadsingle-factor authenticationaccount takeover