Okta FastPass reported phishing attack suspected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires all of the following: Palo Alto Networks Firewall EAL Logs OR XDR Agent Palo Alto Networks Firewall threat Logs
Detection Modules	Identity Analytics
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566)
Severity	Low

Description

Okta FastPass authentication reported a phishing attack suspected.

Attacker's Goals

An attacker might attempt to compromise Okta accounts to gain initial access to the organization, sensitive assets or data.

Investigative actions

• Examine Okta alerts and search for signs of compromise to evaluate the potential risk.
• Examine email logs and headers to understand how the phishing email bypassed email security filters.
• Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available.
• Review recent login attempts, session details, and activity logs in OKTA for anomalies.
• Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign.
• Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.

Variations

Okta FastPass reported phishing attack suspected from a suspicious IP

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Phishing (T1566)
Severity	Medium

Description

Okta FastPass authentication reported a phishing attack suspected.

Attacker's Goals

An attacker might attempt to compromise Okta accounts to gain initial access to the organization, sensitive assets or data.

Investigative actions

• Examine Okta alerts and search for signs of compromise to evaluate the potential risk.
• Examine email logs and headers to understand how the phishing email bypassed email security filters.
• Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available.
• Review recent login attempts, session details, and activity logs in OKTA for anomalies.
• Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign.
• Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.