panther
high
python
Okta Authentication Bypass via Skeleton Key Injection - Behavioral
Detects potential Okta authentication bypass via skeleton key injection using behavioral z-score analysis.
Skeleton key attacks in Okta involve manipulating authentication policies to weaken MFA requirements
(disabling requireFactor, zeroing maxSessionLifetime) and bulk-enrolling attacker-controlled
authenticators on victim accounts. This detection builds a 90-day behavioral baseline for each
admin's policy change and factor enrollment patterns, then identifies anomalous spikes in the last
7 da