Okta: Multiple Users Invalid Login Attempts from Same IP
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in Okta. It specifically looks for events where the login attempt was blocked due to invalid credentials. The rule also incorporates risk scoring based on Okta ThreatInsight detections and behavioral patterns like new geo-location, device, or IP, as well as logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). The detection is triggered if more than 5 distinct user IDs attempt to log in with invalid credentials from the same IP within the specified timeframe.
YARA-L
