Okta API Token Created

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Okta Audit Log
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Okta Audit Analytics
ATT&CK Tactic	Privilege Escalation (TA0004), Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Access Token Manipulation: Make and Impersonate Token (T1134.003), Command and Scripting Interpreter: Cloud API (T1059.009), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Informational

Description

A user created a new API token in Okta.

Attacker's Goals

An attacker's goal is to gain unauthorized access, compromise user accounts, and perform malicious actions within an organization's systems, potentially leading to data breaches, account takeovers, and the escalation of privileges.

Investigative actions

• Review the actions taken by the user that created the token.
• Follow the operations made using this API token by the ID token.
• Contact the user who created the API token and ensure that the API token is needed.

Variations

An Okta API token was generated with suspicious characteristics

Synopsis

Field	Value
ATT&CK Tactic	Privilege Escalation (TA0004), Execution (TA0002), Persistence (TA0003)
ATT&CK Technique	Access Token Manipulation: Make and Impersonate Token (T1134.003), Command and Scripting Interpreter: Cloud API (T1059.009), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Low

Description

A user created a new API token in Okta with suspicious conditions.

Attacker's Goals

An attacker's goal is to gain unauthorized access, compromise user accounts, and perform malicious actions within an organization's systems, potentially leading to data breaches, account takeovers, and the escalation of privileges.

Investigative actions

• Review the actions taken by the user that created the token.
• Follow the operations made using this API token by the ID token.
• Contact the user who created the API token and ensure that the API token is needed.