Analytics BIOC
Informational
✕
A user accessed Okta's admin application
An attempt to access Okta's admin management application.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Okta Audit Log
ATT&CK tactics: Initial Access (TA0001) Persistence (TA0003) Privilege Escalation (TA0004)
ATT&CK techniques: Account Manipulation (T1098) Domain or Tenant Policy Modification (T1484) Valid Accounts (T1078)
Detector tags: Okta Audit Analytics
Attacker's goals:
Adversaries are attempting to infiltrate Okta's administrative application, a breach that could lead to the manipulation of authentication procedures, creation of persistent user accounts, and various activities aiding in the compromise of additional assets.
Investigative actions:
Reach out to the user responsible for the alert to confirm the legitimacy of the activity. Examine the user's actions preceding and following the activation of the alert. Assess the reputation of the IP address along with that of the Autonomous System Number (ASN).
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Suspicious Okta Admin App Access Attempt Low (parent: Informational)