Detection: Okta Successful Single Factor Authentication

Updated Date: 2026-05-13 ID: 98f6ad4f-4325-4096-9d69-45dc8e638e82 Author: Bhavin Patel, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used. This behavior is significant as it may indicate a misconfiguration, policy violation, or potential account takeover. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches or further exploitation within the environment.

Search

 1`okta`  action=success src_user_type = User eventType = user.authentication.verify OR eventType = user.authentication.auth_via_mfa
 2  
 3| stats dc(eventType) values(eventType) as eventType values(target{}.displayName) as targets values(debugContext.debugData.url) min(_time) as firstTime max(_time) as lastTime values(authentication_method)
 4    BY src_ip user action
 5       dest
 6  
 7| `security_content_ctime(firstTime)`
 8  
 9| `security_content_ctime(lastTime)`
10  
11| search targets !="Okta Verify"
12  
13| `okta_successful_single_factor_authentication_filter`

Data Source

Name	Platform	Sourcetype	Source
Okta	Other	`'OktaIM2:log'`	`'Okta'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
okta_successful_single_factor_authentication_filter	`search *`

okta_successful_single_factor_authentication_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1078.004	Cloud Accounts	Initial Access
T1586.003	Cloud Accounts	Persistence
T1621	Multi-Factor Authentication Request Generation	Privilege Escalation

weaponization

Delivery

Exploitation

Installation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

This detection utilizes logs from Okta environments and requires the ingestion of OktaIm2 logs through the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).

Known False Positives

Although not recommended, certain users may be exempt from multi-factor authentication. Adjust the filter as necessary.

Associated Analytic Story

Okta Account Takeover

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
A user [$user$] has successfully logged in to Okta Dashboard with single factor authentication from IP Address - [$src_ip$].	user	user	20

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`okta_log`	`OktaIM2:log`
Integration	✅ Passing	Dataset	`okta_log`	`OktaIM2:log`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 11