Okta User Login Out Of Hours
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
YARA-L
