Okta MFA deactivated
An Okta multifactor authentication factor was deactivated or reset.
What it detects
An Okta multifactor authentication factor was deactivated or reset. Removing MFA weakens account protection and is a common precursor to (or consequence of) account takeover, letting an attacker enrol their own factor or sign in with a stolen password alone.
MITRE ATT&CK mapping
- T1556.006Modify Authentication Process: Multi-Factor Authentication· Persistence
False positives and triage
Help-desk-driven MFA resets are legitimate but should follow an identity-verification process. Correlate with a support ticket and confirm the actor is an authorized administrator, not the target user themselves.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/okta_mfa_deactivated.yaml, licensed under the Apache License 2.0.
id: cloud.okta.mfa_deactivated
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1556.006]
description: |
An Okta multifactor authentication factor was deactivated or reset. Removing MFA weakens
account protection and is a common precursor to (or consequence of) account takeover,
letting an attacker enrol their own factor or sign in with a stolen password alone.
match:
provider: Okta
event_action_any:
- user.mfa.factor.deactivate
- user.mfa.factor.reset_all
- user.account.reset_password
correlation_keys: [user_name]
false_positive_guidance: |
Help-desk-driven MFA resets are legitimate but should follow an identity-verification
process. Correlate with a support ticket and confirm the actor is an authorized
administrator, not the target user themselves.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.