Sigma rule: Potential Okta Password in AlternateID Field

Rule

Title

Potential Okta Password in AlternateID Field

Status

test

Level

high

Author

kelnage

Date

2023-04-03

Modified

2026-04-27

File

rules/identity/okta/okta_password_in_alternateid_field.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.

Log source

product

okta

service

okta

Detection

selection:
    legacyEventType: 'core.user_auth.login_failed'
filter_main:
    # Okta service account names start with 0oa
    # Email addresses are the default format for Okta usernames, so attempt
    # to exclude alternateIds that look like valid emails
    # If your Okta configuration uses different character restrictions, you
    # will need to update this regular expression to reflect that or disable the rule for your environment
    # Possible false negatives are failed login attempts with a password that looks like a valid email address
    actor.alternateId|re: '(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})'
condition: selection and not filter_main

False positives (as the rule lists them)

• Unlikely

Tags

• attack.credential-access
• attack.t1552

MITRE ATT&CK ids this rule names

• T1552

References

• https://developer.okta.com/docs/reference/api/system-log/
• https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
• https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/identity/okta/okta_password_in_alternateid_field.yml