Okta security policy deactivated
An Okta sign-on / MFA / password policy or rule was deactivated or deleted.
What it detects
An Okta sign-on / MFA / password policy or rule was deactivated or deleted. Turning off a security policy removes an enforced control (for example an MFA requirement or an IP restriction) and is a defence-evasion move that broadens the attacker's access.
MITRE ATT&CK mapping
- T1562Impair Defenses· Defense Evasion
False positives and triage
Policy tuning happens during legitimate administration. Confirm the change was planned, and treat deactivation of MFA or sign-on policies as high priority until tied to an approved change.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/okta_security_policy_deactivated.yaml, licensed under the Apache License 2.0.
id: cloud.okta.security_policy_deactivated
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1562]
description: |
An Okta sign-on / MFA / password policy or rule was deactivated or deleted. Turning off
a security policy removes an enforced control (for example an MFA requirement or an IP
restriction) and is a defence-evasion move that broadens the attacker's access.
match:
provider: Okta
event_action_any:
- policy.lifecycle.deactivate
- policy.lifecycle.delete
- policy.rule.deactivate
- policy.rule.delete
correlation_keys: [user_name]
false_positive_guidance: |
Policy tuning happens during legitimate administration. Confirm the change was planned,
and treat deactivation of MFA or sign-on policies as high priority until tied to an
approved change.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.