Okta device enrolled
A new device was enrolled against an Okta account (device.enrollment.create).
What it detects
A new device was enrolled against an Okta account (device.enrollment.create).
Enrolling a device registers a trusted authenticator. Done by an attacker who already has the password and one MFA approval, it converts that transient access into a factor they hold — after which they satisfy MFA on their own hardware and no longer need the victim to approve anything.
MITRE ATT&CK mapping
- T1098.005Account Manipulation: Device Registration· Persistence
False positives and triage
Device enrollment is normal onboarding and normal phone replacement, so this fires on routine activity and is rated as context rather than a verdict. The signal is enrollment from an IP or country the user has never signed in from, enrollment shortly after a suspicious sign-in or a password reset, or a second device added to an account that has only ever had one. Ask the user.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/okta_device_enrolled.yaml, licensed under the Apache License 2.0.
id: cloud.okta.device_enrolled
version: 1.0.0
status: stable
severity: medium
confidence: 0.5
platforms: [application]
mitre_techniques: [T1098.005]
description: |
A new device was enrolled against an Okta account (`device.enrollment.create`).
Enrolling a device registers a trusted authenticator. Done by an attacker who
already has the password and one MFA approval, it converts that transient access
into a factor they hold — after which they satisfy MFA on their own hardware and no
longer need the victim to approve anything.
match:
provider: Okta
event_action_contains_any:
- device.enrollment.create
correlation_keys: [user_name]
false_positive_guidance: |
Device enrollment is normal onboarding and normal phone replacement, so this fires
on routine activity and is rated as context rather than a verdict. The signal is
enrollment from an IP or country the user has never signed in from, enrollment
shortly after a suspicious sign-in or a password reset, or a second device added to
an account that has only ever had one. Ask the user.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.