{"id":"91b76b84-8589-47aa-9605-c837583b82a9","title":"Potential Okta Password in AlternateID Field","description":"Detects when a user has potentially entered their password into the\nusername field, which will cause the password to be retained in log files.\n","author":"kelnage","status":"test","level":"high","date":"2023-04-03","modified":"2026-04-27","tags":["attack.credential-access","attack.t1552"],"technique_ids":["T1552"],"logsource":{"product":"okta","service":"okta"},"falsepositives":["Unlikely"],"references":["https://developer.okta.com/docs/reference/api/system-log/","https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data","https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm"],"source_path":"rules/identity/okta/okta_password_in_alternateid_field.yml","source_sha256":"ca027bbe789f574937f1ef75311ad91f1e3e173f32bd97c79381cb4c7308d805","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/identity/okta/okta_password_in_alternateid_field.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Okta Password in AlternateID Field\nid: 91b76b84-8589-47aa-9605-c837583b82a9\nstatus: test\ndescription: |\n    Detects when a user has potentially entered their password into the\n    username field, which will cause the password to be retained in log files.\nreferences:\n    - https://developer.okta.com/docs/reference/api/system-log/\n    - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data\n    - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm\nauthor: kelnage\ndate: 2023-04-03\nmodified: 2026-04-27\ntags:\n    - attack.credential-access\n    - attack.t1552\nlogsource:\n    product: okta\n    service: okta\ndetection:\n    selection:\n        legacyEventType: 'core.user_auth.login_failed'\n    filter_main:\n        # Okta service account names start with 0oa\n        # Email addresses are the default format for Okta usernames, so attempt\n        # to exclude alternateIds that look like valid emails\n        # If your Okta configuration uses different character restrictions, you\n        # will need to update this regular expression to reflect that or disable the rule for your environment\n        # Possible false negatives are failed login attempts with a password that looks like a valid email address\n        actor.alternateId|re: '(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,10})'\n    condition: selection and not filter_main\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","page":"techniques/enterprise/T1552/"}],"data_path":"data/detection-rules/91b76b84-8589-47aa-9605-c837583b82a9.json","kind":"sigma"}