Suspicious authenticator enrollment

This detection is recorded when Okta identifies suspicious activity during an authenticator enrollment event. The specific criteria and event details that triggered the alert are recorded in the System Log event user.risk.detect for investigation.

Detection risk level: High

This detection suggests that an attacker has potentially compromised the account and is attempting to establish persistence by adding their own authenticator. Accessing the account and registering an unauthorized factor allows an adversary to maintain long-term access to the user account.

MITRE tactic

Persistence

MITRE technique

Account Manipulation: Device Registration

Policy configuration

In your entity risk policy, set these conditions:

  • Detection: Suspicious Authenticator Enrollment

  • Take this action: Universal Logout + authenticator reset using Okta Workflows

System Log query

eventType eq "user.risk.detect" and debugContext.debugData.risk co "detectionName=Suspicious Authenticator Enrollment"

Remediation strategy

The core objective of this remediation is to immediately stop the attacker's activity, revoke unauthorized authenticators, and fully secure the compromised account.

  1. Immediate action: Based on your policy configuration, an Okta workflow can launch Universal Logout to terminate the active session and trigger an automated authenticator reset to remove the newly enrolled factor.

  2. Block the threat: Add the malicious IP address to a blocked network zone. Or, enable ThreatInsight in block mode to prevent any further attempts.

  3. Investigate: This is a critical alert. Immediately check the System Log for the specific action.

    • Review the System Log entries to evaluate the specific risk factors and contextual parameters associated with the detection.

    • For authenticator registration, check the user's authenticator list. If a new one was successfully added, verify if the workflow removed it or reset it immediately.

    • Check user activity and downstream app logs during the sessions immediately surrounding the enrollment event.

  4. Secure the account:

    • Force a password reset.

    • Clear all sessions and reset all MFA factors for the user.

    • Begin an audit of all user actions performed during the suspicious session time frame.