Okta new rules

[arielkr256]

Background

Okta is a centralized identity platform that serves as a modern alternative to traditional on-premises Domain Controllers for organizations. It provides a secure and unified way to manage user authentication, access control, and identity management across various applications and services. While the increased centralization of access controls can protect end users, it also presents a high-value target for attackers.

In a keynote address at the mWISE Conference 2023, Kevin Mandia stated that defenders must assume phishing attacks will be successful on their employees and that valid accounts will be used for lateral movement by attackers. Recent attacks, such as the scattered spider attacks on MGM and Caesar's, have confirmed these concerns. These attacks involved social engineering and phishing techniques to gain access to legitimate Okta admin accounts.

The Okta security team has emphasized that there were no vulnerabilities in the Okta platform that were exploited in these attacks. Instead, the attackers took advantage of misconfigurations and a lack of security controls to leverage compromised accounts into additional access, privileges, and persistence. It is crucial for organizations to closely monitor and detect new Tactics, Techniques, and Procedures (TTPs) in the Okta audit logs to identify any suspicious activities and potential security breaches.

Changes

• 7 new detections based on recent high profile attacks by threat actors including LAPSU$, Scatter Swine, and Scattered Spider

Testing

• sample logs are included for unit tests

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ arielkr256
❌ grantjoy
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[darwayne]

LGTM, had some minor nit picks

[arielkr256]

cleaned up some unused yaml fields

[egibs]

Lots of comments, but most revolve around specifying an appropriate defaults for deep_get calls and certain gets.