Okta unauthorized app access
An attempt to reach an Okta-managed application the account is not assigned to (app.generic.unauth_app_access_attempt).
What it detects
An attempt to reach an Okta-managed application the account is not assigned to (app.generic.unauth_app_access_attempt).
A legitimate user navigates to apps from their own dashboard, which only shows what they are assigned; they rarely hit an app they cannot use. Repeated or varied attempts are someone probing what the tenant contains — enumerating the application estate to find a target — which is reconnaissance an assigned-access model would otherwise hide.
MITRE ATT&CK mapping
False positives and triage
A stale bookmark, a deep link shared between colleagues, or an app assignment that was just removed all produce this once, and that single occurrence is not interesting. The signal is one account attempting SEVERAL different apps it is not assigned to, attempts from an unfamiliar IP, or attempts by an account whose sign-in already looked anomalous. Check which apps were targeted — reconnaissance tends to reach for the administrative and financial ones.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/okta_unauthorized_app_access.yaml, licensed under the Apache License 2.0.
id: cloud.okta.unauthorized_app_access
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1087.004, T1078.004]
description: |
An attempt to reach an Okta-managed application the account is not assigned to
(`app.generic.unauth_app_access_attempt`).
A legitimate user navigates to apps from their own dashboard, which only shows what
they are assigned; they rarely hit an app they cannot use. Repeated or varied
attempts are someone probing what the tenant contains — enumerating the application
estate to find a target — which is reconnaissance an assigned-access model would
otherwise hide.
match:
provider: Okta
event_action_contains_any:
- unauth_app_access_attempt
correlation_keys: [user_name]
false_positive_guidance: |
A stale bookmark, a deep link shared between colleagues, or an app assignment that
was just removed all produce this once, and that single occurrence is not
interesting. The signal is one account attempting SEVERAL different apps it is not
assigned to, attempts from an unfamiliar IP, or attempts by an account whose
sign-in already looked anomalous. Check which apps were targeted — reconnaissance
tends to reach for the administrative and financial ones.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.