Identity Threats pack
The Identity Threats pack detects and hunts account takeover across Okta, Microsoft Entra ID and Google Workspace. It schedules queries for MFA fatigue, risky and impossible-travel sign-ins, OAuth consent grants, admin role grants, new application credentials, legacy authentication, suspicious Google logins and domain-wide delegation. It checks for admins without MFA, switches on identity correlation watchers, and brings hunts for token theft, session hijacking, consent phishing and password spraying.
It's an optional content pack: Huntbase makes it available to your organisation, and it runs only once an organisation admin enables it.
Use it to answer questions like "who granted a new app access to mail?", "which admins have no MFA?" and "is someone pushing MFA prompts at one of our users?".
Content packs are currently rolling out and may not be enabled for your organisation.
At a glance
| Publisher | Huntbase |
| Version | 0.1.0 |
| Built on | Huntbase core, and the Identity and SaaS integration packs (all always on) |
| Needs these sources | Any one of Microsoft Entra ID, Okta, Google Workspace or Google Directory |
| What runs with Recommended | Ten scheduled queries on your identity connections, and one watcher |
| Report template | Identity incident review |
| Licence | Huntbase content licence |
What it watches
Scheduled queries
Twenty queries that run on your identity connections. Queries that look at events look back slightly further than their interval, so nothing falls between runs. Queries marked ✓ run with Recommended; Everything runs all of them.
Microsoft Entra ID
| Query | Runs | Recommended |
|---|---|---|
| Entra ID Repeated MFA Denials: three or more MFA denials for one user | Hourly | ✓ |
| Entra ID Risky Sign-Ins (needs Entra ID P2) | Hourly | ✓ |
| Entra ID Impossible Travel Sign-Ins: sign-ins from two countries less than three hours apart | Hourly | |
| Entra ID OAuth Consent Grants | Hourly | ✓ |
| Entra ID Privileged Role Assignments | Hourly | ✓ |
| Entra ID Application Credentials and Owners Added | Hourly | |
| Entra ID Legacy Authentication Sign-Ins | Every 6 hours | |
| Entra ID Admins Without MFA Registered | Daily | ✓ |
| Entra ID Privileged Role Holders | Daily |
Okta
| Query | Runs | Recommended |
|---|---|---|
| Okta Active Users Without an Active MFA Factor | Daily | ✓ |
| Okta Admin Role Holders | Daily | |
| Okta MFA Factors Enrolled in the Last Day | Daily | |
| Okta Applications Added in the Last Day | Daily |
Google Workspace
| Query | Runs | Recommended |
|---|---|---|
| Google Workspace OAuth Grants with Sensitive Scopes | Hourly | |
| Google Workspace Admin Role Grants | Hourly | ✓ |
| Google Workspace Suspicious Logins | Hourly | ✓ |
| Google Workspace 2SV and Recovery Changes | Hourly | |
| Google Workspace Login Failure Bursts | Hourly | |
| Google Workspace Domain-Wide Delegation Grants | Every 6 hours | ✓ |
| Google Workspace Admins Without 2-Step Verification (Google Directory) | Daily | ✓ |
Each query runs only on connections to its own product. You can change a query's schedule for your organisation, or switch it off on the Contents tab.
Okta sign-in events reach Huntbase as the Okta System Log in your telemetry, and this version's scheduled queries don't cover them. Look at Okta sign-ins in your telemetry or through the pack's hunts.
Watchers
| Watcher | What it notices | Recommended |
|---|---|---|
| One identity flagged by identity and cloud tools | The same user account flagged by two different security products within the hour, for example an anomalous sign-in from the identity provider and a new access key from the cloud provider | ✓ |
| One identity, several hosts | Insights involving the same user account on two or more hosts, the shape of lateral movement or a reused compromised account | |
| Over-privileged identity | An identity you own that has admin-level access |
When a watcher matches, it generates a detection.
Some watchers need Huntbase to make them available to your organisation. Over-privileged identity isn't available yet. Until a watcher is available, it shows Blocked on the Contents tab and isn't counted in what the pack runs.
Library content
- The Okta, Microsoft Entra ID and Google Directory integrations with all their query templates, and the Google Workspace login, admin and mailbox templates. These are Library content: run them as query templates or let Scout use them.
- Twenty-six hunts from Huntbase Hub covering OAuth token theft, device code and consent phishing, session hijacking and adversary-in-the-middle phishing, MFA fatigue and password spraying, Okta and SSO takeover, admin role and tenant abuse, and impossible travel. They're in the Library and run only when you or Scout start one.
Report template
Identity incident review lays out a hunt report for a suspected account takeover: the verdict first, then the affected identities, the entry vector, sessions and tokens, privileged changes, containment steps taken and still needed, coverage gaps and recommendations. Hunts can use it while the pack is enabled.
Sources it needs
Connect at least one of these. Each one you add runs its own queries.
| Source | What it adds |
|---|---|
| Microsoft Entra ID | Nine queries: sign-in risk, MFA denials, consent grants, role changes and admins without MFA. Risky sign-ins need an Entra ID P2 licence. |
| Okta | Four queries: users without MFA, admin role holders, new factors and new applications |
| Google Workspace | Six queries: OAuth grants, admin role grants, suspicious logins, 2SV changes, login failures and domain-wide delegation |
| Google Directory | One query: admins without 2-step verification |
You can enable the pack before you connect a source. Queries without one show Waiting for a source and start on their own once you connect it.
Enable it
- Choose the organisation in the Scope selector. You need to be an organisation admin, or have Content packs: Manage for this pack.
- Open Library › Packs › Identity Threats and click Enable. If the page says Ask your Huntbase administrator to make this pack available, contact Huntbase.
- Keep Recommended, or choose Everything or Library only. Recommended runs the ten queries chosen for low noise and the One identity flagged by identity and cloud tools watcher. The preview shows which of your connections they run on and roughly how many runs a day they add.
- Click Enable pack.
See Enable a pack for the full flow.
What it may do
The Licence and trust tab lists what the pack may do. Identity Threats runs read-only queries against your connections. It doesn't propose actions.
Work with the results
- Ask Scout "which admins have no MFA?" or "show me OAuth consent grants from the last day".
- When a query turns up a consent grant, role change or MFA burst you don't recognise, start one of the pack's hunts from the Library and write it up with the Identity incident review template.
- Give the team that owns identity Content packs: Manage limited to this pack, so it can tune and update it.
Disable it
Open the pack and click Disable. Its schedules are paused and its watchers stop. Your switches and customised items are kept for when you enable it again, and results and hunts stay. See Disable a pack.
Next steps
- Content packs — presets, customising items, updates and permissions
- Connections — connect Okta, Entra ID or Google Workspace
- Hunt playbooks — start one of the pack's hunts
- Chatting with Scout — ask about identities and sign-ins