Okta MFA Reset or Deactivated

Title: Okta MFA Reset or Deactivated
Status: test
Description:Detects when an attempt at deactivating or resetting MFA.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://developer.okta.com/docs/reference/api/event-types/
Author: Austin Songer @austinsonger
Date: 2021-09-21
modified:2026-04-27
Tags:

• -'attack.persistence'
• -'attack.credential-access'
• -'attack.defense-impairment'
• -'attack.t1556.006'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    eventType:
      -'user.mfa.factor.deactivate'
      -'user.mfa.factor.reset_all'

  condition:selection
Falsepositives:
  -If a MFA reset or deactivated was performed by a system administrator.
Level: medium