Auth0
Telemetry Evidence
These values show how indexed rules identify Auth0 telemetry.Panther
Auth0.Events auth0 panther_logs.public.auth0_events Sigma
auth0
Detection Rules
Panther #
- Auth0 Attack Protection Monitoring Disabled source high: An attack protection monitoring configuration was changed.
T1685 - Auth0 Bot Detection Policy Disabled source high: A bot detection policy was disabled.
T1685 - Auth0 Brute Force Detection source
- Auth0 CIC Credential Stuffing source high: Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks. Okta has observed suspicious activity that started on April 15, 2024. Review tenant logs for unexpected fcoa and scoa events.
- Auth0 CIC Credential Stuffing Query source: Okta has determined that the cross-origin authentication feature in Customer Identity Cloud (CIC) is prone to being targeted by threat actors orchestrating credential-stuffing attacks. Okta has observed suspicious activity that started on April 15, 2024. Review tenant logs for unexpected fcoa, scoa, and pwd_leak events. https://sec.okta.com/articles/2024/05/detecting-cross-origin-authentication-credential-stuffing-attacks
- Auth0 Custom Role Created source high: An Auth0 User created a role in your organization's tenant.
- Auth0 Delete Tenant Member source informational: A tenant member was deleted.
T1041 - Auth0 Fraud Risk by Volume source high: Detects a surge in either failed, successful or suspicious login attempts using leaked passwords over a window of time and a threshold. Exceeding set threshold may indicate potential fraud.
T1136 - Auth0 Integration Installed source informational: An Auth0 integration was installed from the auth0 action library.
- Auth0 Leaked Password Login Attempt source medium: Detect Auth0 Leaked Password Login Attempt
Show 14 more
- Auth0 Limit Detections source medium: Detect Auth0 Limit Logs
- Auth0 mfa factor enabled source informational: An Auth0 user enabled an mfa factor in your organization's mfa settings.
- Auth0 MFA Policy Disabled source high: An Auth0 User disabled MFA for your organization's tenant.
- Auth0 MFA Policy Enabled source medium: An Auth0 User enabled MFA Policy for your organization's tenant.
- Auth0 MFA Risk Assessment Disabled source high: An Auth0 User disabled the mfa risk assessment setting for your organization's tenant.
- Auth0 MFA Risk Assessment Enabled source informational: An Auth0 User enabled the mfa risk assessment setting for your organization's tenant.
- Auth0 New Admin Invited source informational: A new admin invitation was issued.
T1136 - Auth0 Post Login Action Flow Updated source medium: An Auth0 User updated a post login action flow for your organization's tenant.
- Auth0 Push Notification Fatigue source high: Push notifications threshold exceeded for a user. It may indicate a push notification fatigue attempt.
T1621 - Auth0 Rapid Dynamic Client Creation source high: Detects a spike in registered dynamic clients. This can indicate attempts to use such dynamic clients for malicious purposes.
T1136 - Auth0 Refresh Token Reused source high: A refresh token was reused.
T1528 - Auth0 Same Phone Number Shared Across Multiple Users as MFA source high: Detecs when more than one user shares a phone number with another for MFA purposes. Attackers may register their phone number for multiple compromised accounts.
T1098 - Auth0 User Invitation Created source informational
- Auth0 User Joined Tenant source informational: User accepted invitation from Auth0 member to join an Auth0 tenant.
Sigma #
- Account takeover via account linking using a delegated user token source high: Detects potential account takeover through abuse of Auth0 account linking. In the "Auth0 defaults" attack chain (e.g. an XSS or implicit-grant foothold in a SPA), an attacker obtains a current_user-delegated Management API token and adds an identity they control to another user's account via POST /api/v2/users/{id}/identities ("Link a User Account"). Once linked, authenticating with the attacker-controlled identity resolves to the victim's primary account, i.e. full account takeover. Benign self-service linking uses the exact same API call, so this rule keys on the delegated-token shape of the event and then on the tell-tale result of the attack: an account that holds more identities than distinct connections, i.e. at least two identities merged into one account that share a single connection, which normal cross-connection linking does not produce.
T1098 - Attack protection features manipulation - some attack protection features have been disabled. source medium: This detection alerts when attack protection features have been disabled in the tenant's settings. This detection covers Suspicious IP Throttling, Breached Password Detection, and Brute-force protection.
T1685,T1686.001 - Bot detection - the feature is turned off completely or some policies. source medium: Detect when the Bot detection feature is not enforcing protection on any of the supported flows. This can allow malicious actors to conduct scripted attacks without being detected and blocked.
T1685,T1686.001 - Breached Password Detection - critical settings manipulated source medium: Detect when Breached Password Detection has been disabled at all or set to a monitoring mode where no blocking occurs. This can allow malicious actors to conduct credential stuffing without being detected and blocked.
T1685,T1686.001 - Brute Force Protection - critical settings manipulated source medium: Detect when Brute Force Protection has been disabled at all or set to a monitoring mode where no blocking occurs. This can allow malicious actors to continue brute force attacks without being detected and blocked.
T1685,T1686.001 - Creation of large amount of unverified accounts source medium: Detect rapid creation of large amounts of unverified accounts, which may be a precursor to fraudulent activity or account exploitation. Unverified accounts can be created by attackers or automated bots attempting to test the system or conduct fraudulent activities.
- Credential stuffing sttack risk source medium: Detects potential credential stuffing attacks by monitoring failed logins and Auth0 Attack Protection feature events.
T1110,T1110.004 - High Risk Actions - copying of the most powerful token through API Explorer source medium: The Auth0 Dashboard generates automatically a special token that is authorized to use all available Management API scopes (except for newly released scopes that shall be added manually). This token can be copied via Applications --> APIs --> Auth0 Management API --> API Explorer.
T1528 - High risk event - grant Management APIs scopes source medium: Excessive permissions can lead to unauthorized access. Auth0 Management API scopes should be given to trusted applications and monitored.
T1548 - High risk event - risk of copying client credentials source medium: Detect potential risks of copying client credentials by monitoring if a client is read via the Dashboard or Management API. This can indicate that someone is trying to copy client credentials for malicious purposes.
T1528
Show 23 more
- Insecure OAuth2.x flows have been enabled for some applications source medium: Detect when applications' configurations have been updated with insecure grant types, e.g. implicit and resource owner password grant. According to the recent update OAuth2.1 and RFC 9700, these flows shall be avoided.
T1685,T1686.001 - Loaded LiquidJS error page template contains XSS vulnerabilities source: This detection monitors if there are patterns that indicate potential Cross-Site Scripting (XSS) vulnerabilities in a LiquidJS error page template.
T1685,T1686.001 - MFA attack - bombarding a user with SMS for MFA source medium: A threat actor can try to bombard a user with SMS messages for MFA in order to deplete the customer's SMS quota leading to Denial of Service.
T1499,T1499.002 - MFA downgrade - adaptive MFA risk assessment disabled source medium: Detects modifications to the Multi-Factor Authentication (MFA) risk assessment configuration that disables the collection of risk signals after authentication. These signals are often leveraged to calculate customized session risk within post-login Actions, for example, to trigger MFA challenge or deny access. When recording of these risk signals has been disabled, it reduces efficiency of corresponding security controls. This activity is a major security downgrade that can be performed by an attacker to evade detection.
T1685,T1686.001 - MFA downgrade - disable MFA policies by modifying the policies source: Detect when the MFA policy is turned off by setting it to "Never".
T1685,T1686.001 - MFA downgrade - disable strong factors source medium: An adversary can try to downgrade authentication requirements by disabling strong authenticators (Webauthn) for users.
T1685,T1686.001 - MFA Push Fatigue - detects when a user is repeatedly prompted for MFA push. source medium: An adversary with access to compromised passwords may try to push bomb the victim. There is a chance that the victim will accept an MFA prompt to stop irritation.
T1621 - Rapid creation of clients with the dynamic client registration endpoint source medium: Detect when a large number of clients are created in a short period of time using dynamic client registration. This can indicate an attempt to create multiple clients for malicious purposes, such as denial of service, resource exhaustion, phishing (consent phishing) by creating look-alike applications, and causing admin fatigue by overwhelming the admin with clients.
T1499,T1566 - Refresh Token Exchange from Excessive Locations source medium: Detects when a refresh token is exchanged for an access token from an unusual volume of distinct locations (IP addresses, ASNs, or Geolocation). An excessive number of locations suggests the refresh token may be hijacked and actively used by an attacker, potentially indicating initial access and impersonation.
T1078,T1550,T1550.004 - Refresh Token Exchange from Multiple User Agents source medium: Detects when a refresh token is exchanged for an access token from an unusual volume of distinct User Agents (UAs). The use of a single refresh token across an excessive number of UAs strongly suggests the token has been hijacked and is actively being used by an attacker.
T1078,T1550,T1550.004 - Refresh Token Reuse Detection source medium: This detection alerts when a refresh token is reused in an unsuccessful exchange attempt. Reusing refresh tokens can indicate an attempt to exploit the token or a misconfiguration in the application. This detection requires that the token rotation is enabled for an application.
T1078,T1550,T1550.001 - Risk for account takeover - phone number registered to multiple users source medium: An adversary can try to register the same phone number (for the SMS delivery) as a second factor (MFA) to multiple compromised accounts in order to maintain persistence.
T1098 - Risk for account takeover - same Guardian application device is registered for MFA to multiple users source medium: An adversary may register their own MFA devices, often leveraging the same device for multiple compromised accounts to maintain persistence.
T1098 - Risk for misconfiguration - use of Auth0 tenant name URL. source medium: Detect the use of Auth0 canonical domain/tenant name url, when a custom domain is configured. When a custom domain is configured, there is often no reason for legitimate applications to use the default Auth0 domain. An attempt to access the tenant using the default Auth0 domain that may indicate a misconfiguration or an attack. Bypassing of a custom domain can lead to circumventing of such protections as WAF, IP filters, and advanced logging.
T1685,T1686.001 - Risk of signup fraud - rapid creation of fake accounts source medium: Detect potential signup fraud by monitoring the following events: surge in a number of registration, excessive failed signups, or too many signup attempts with use of breached passwords.
T1136 - Risk of signup fraud - rapid creation of fake accounts with disposable email domains source medium: Detect potential signup fraud by monitoring the use of disposable emails.
T1136 - Risk of Tenant Takeover source medium: Detect potential tenant takeover risks by monitoring if a new tenant admin has been invited followed by rapid deletion of other Tenant Admins.
T1098,T1136 - Successful login correlated with suspicious JA4/JA3 TLS fingerprint source medium: Detects if there are successful logins from JA3 or JA4 signatures seen in credential stuffing patterns. This is a strong indication that the respective accounts have been compromised.
T1110,T1110.004 - Successful Logins and Signups from Flagged IPs source medium: Detects when successful login and signup events are observed from IP addresses that have also been flagged by a tenant's attack protection features. The correlation of these suspicious IPs with successful login and signup events can indicate a compromised account or a successful credential-based attack (e.g., credential stuffing). This detection includes events from Suspicious IP Throttling, Breached Password Detection, Brute-force protection, and Bot Detection.
- Suspicious IP Throttling - critical settings manipulated source medium: A threat actor can manipulate the critical settings of Suspicious IP Throttling, such as disabling the feature or setting it to a monitoring mode where no blocking occurs. This can allow malicious IPs to bypass protections and continue attacks without being blocked.
T1685,T1686.001 - Too many failed authorization requests due to wrong parameters source: Detect when a request for authorization provides an unregistered redirect URI, audience, client, unsupported response type, or unsupported challenge type. An adversary may try to harvest authorization codes for exchanging them for tokens later, or simply conducting a denial-of-service attack by depleting the rate limit.
T1110 - Unauthorized or Unexpected Enabling of Cross-Origin Authentication (CORS) source medium: Detects when cross-origin authentication (CORS) has been enabled for an application. Cross-origin authentication feature often targeted by threat actors to conduct credential stuffing attacks. Monitoring this change helps preemptively reduce the risk of this attack vector.
T1685,T1686.001 - Unrecognized IP in attack protection allowlists source medium: Detect when new IPs are added into any attack protection allowlist. Since allowlists suspend some controls, they should be closely monitored for unrecognized IPs. A threat actor can try to add a malicious IP in order to bypass attack protection features.
T1685,T1686.001
Package-Only Rules
These rules appear in a Auth0 source package, but their queries do not identify Auth0 telemetry. They do not count toward Rules.Panther #
Sigma #
T1685, T1686.001