add dataset okta mfa

splunk · Mar 11, 2024 · 7e7f0c2 · 7e7f0c2
1 parent b0a2d98
commit 7e7f0c2
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.json b/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.json
diff --git a/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.yml b/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.yml
@@ -0,0 +1,14 @@
+author: Mauricio Velazco
+id: 6a21e46e-d759-11e0-bbd6-932611ee01ad
+date: '2024-03-05'
+description: 'Manually generated multple failed MFA requests for a user in Okta.
+  Tenant specific details have been replaced in the dataset including tenant id, user names, ips, etc.'
+environment: Okta Tenant
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed.json
+sourcetypes:
+- OktaIM2:log
+references:
+- https://attack.mitre.org/techniques/T1621/ 
+- https://attack.mitre.org/techniques/T1078/004/
+- https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/