Okta Authentication Bypass via Skeleton Key Injection - Behavioral
Detects potential Okta authentication bypass via skeleton key injection using behavioral z-score analysis. Skeleton key attacks in Okta involve manipulating authentication policies to weaken MFA requirements (disabling requireFactor, zeroing maxSessionLifetime) and bulk-enrolling attacker-controlled authenticators on victim accounts. This detection builds a 90-day behavioral baseline for each admin's policy change and factor enrollment patterns, then identifies anomalous spikes in the last 7 days. **Detection Logic:** - Z-score: Spike in security-weakening policy changes (> 2σ above baseline) - Z-score: Spike in admin-on-behalf-of MFA factor enrollments (> 3σ above baseline) - Cold-start: First-time security weakening (no prior baseline - immediate high-confidence signal) - Cold-start: First-time admin-enrolled factors for other users **Why This Matters:** Skeleton key attacks require two steps: weaken authentication policies to reduce MFA friction, then enroll attacker-controlled authenticators on victim accounts. This detection catches both steps using behavioral baselines that adapt to legitimate admin workflows. **Complementary Detection:** Use alongside `Okta.ADAgent.TokenAbuse.Behavioral` for admin credential theft scenarios.
Detection Logic
def rule(event):
# Query already filtered for is_anomalous = TRUE.
# Guard against malformed rows missing the primary key field.
return bool(event.get("admin_email"))
def title(event):
admin = event.get("admin_email", "Unknown")
recent_weakenings = event.get("recent_total_weakenings") or 0
recent_admin_enrollments = event.get("recent_total_admin_enrollments") or 0
if recent_weakenings > 0:
return f"Okta Skeleton Key: Security Policy Weakening by {admin}"
if recent_admin_enrollments > 0:
return f"Okta Skeleton Key: Bulk Admin Factor Enrollment by {admin}"
return f"Okta Skeleton Key Bypass Anomaly Detected for {admin}"
def severity(event):
score = event.get("anomaly_severity_score") or 0
is_first_security_weakening = event.get("is_first_time_security_weakening") or False
recent_weakenings = event.get("recent_total_weakenings") or 0
if is_first_security_weakening or (recent_weakenings > 0 and score > 20):
return "CRITICAL"
if recent_weakenings > 0 or score > 15:
return "HIGH"
return "MEDIUM"
def dedup_key(event):
admin = event.get("admin_email", "unknown")
first_event = str(
event.get("recent_policy_first_event")
or event.get("recent_enrollment_first_event", "unknown")
)[:10]
return f"okta_skeleton_key_{admin}_{first_event}"
def alert_context(event):
return {
"admin_email": event.get("admin_email"),
"recent_total_weakenings": event.get("recent_total_weakenings"),
"recent_total_admin_enrollments": event.get("recent_total_admin_enrollments"),
"z_score_security_weakenings": event.get("z_score_security_weakenings"),
"z_score_admin_enrollments": event.get("z_score_admin_enrollments"),
"anomaly_severity_score": event.get("anomaly_severity_score"),
"is_first_time_security_weakening": event.get("is_first_time_security_weakening"),
"is_first_time_admin_enrollment": event.get("is_first_time_admin_enrollment"),
"baseline_total_weakenings": event.get("baseline_total_weakenings"),
"recent_policy_first_event": event.get("recent_policy_first_event"),
"recent_policy_last_event": event.get("recent_policy_last_event"),
}Field Validations
Loading…
Comments (0)
Loading comments...