Okta Authentication Bypass via Skeleton Key Injection - Behavioral

Description

Detects potential Okta authentication bypass via skeleton key injection using behavioral z-score analysis.

Skeleton key attacks in Okta involve manipulating authentication policies to weaken MFA requirements (disabling requireFactor, zeroing maxSessionLifetime) and bulk-enrolling attacker-controlled authenticators on victim accounts. This detection builds a 90-day behavioral baseline for each admin's policy change and factor enrollment patterns, then identifies anomalous spikes in the last 7 days.

Detection Logic: - Z-score: Spike in security-weakening policy changes (> 2σ above baseline) - Z-score: Spike in admin-on-behalf-of MFA factor enrollments (> 3σ above baseline) - Cold-start: First-time security weakening (no prior baseline - immediate high-confidence signal) - Cold-start: First-time admin-enrolled factors for other users

Why This Matters: Skeleton key attacks require two steps: weaken authentication policies to reduce MFA friction, then enroll attacker-controlled authenticators on victim accounts. This detection catches both steps using behavioral baselines that adapt to legitimate admin workflows.

Complementary Detection: Use alongside Okta.ADAgent.TokenAbuse.Behavioral for admin credential theft scenarios.

Query · python

def rule(event):
    # Query already filtered for is_anomalous = TRUE.
    # Guard against malformed rows missing the primary key field.
    return bool(event.get("admin_email"))


def title(event):
    admin = event.get("admin_email", "Unknown")
    recent_weakenings = event.get("recent_total_weakenings") or 0
    recent_admin_enrollments = event.get("recent_total_admin_enrollments") or 0
    if recent_weakenings > 0:
        return f"Okta Skeleton Key: Security Policy Weakening by {admin}"
    if recent_admin_enrollments > 0:
        return f"Okta Skeleton Key: Bulk Admin Factor Enrollment by {admin}"
    return f"Okta Skeleton Key Bypass Anomaly Detected for {admin}"


def severity(event):
    score = event.get("anomaly_severity_score") or 0
    is_first_security_weakening = event.get("is_first_time_security_weakening") or False
    recent_weakenings = event.get("recent_total_weakenings") or 0
    if is_first_security_weakening or (recent_weakenings > 0 and score > 20):
        return "CRITICAL"
    if recent_weakenings > 0 or score > 15:
        return "HIGH"
    return "MEDIUM"


def dedup_key(event):
    admin = event.get("admin_email", "unknown")
    first_event = str(
        event.get("recent_policy_first_event")
        or event.get("recent_enrollment_first_event", "unknown")
    )[:10]
    return f"okta_skeleton_key_{admin}_{first_event}"


def alert_context(event):
    return {
        "admin_email": event.get("admin_email"),
        "recent_total_weakenings": event.get("recent_total_weakenings"),
        "recent_total_admin_enrollments": event.get("recent_total_admin_enrollments"),
        "z_score_security_weakenings": event.get("z_score_security_weakenings"),
        "z_score_admin_enrollments": event.get("z_score_admin_enrollments"),
        "anomaly_severity_score": event.get("anomaly_severity_score"),
        "is_first_time_security_weakening": event.get("is_first_time_security_weakening"),
        "is_first_time_admin_enrollment": event.get("is_first_time_admin_enrollment"),
        "baseline_total_weakenings": event.get("baseline_total_weakenings"),
        "recent_policy_first_event": event.get("recent_policy_first_event"),
        "recent_policy_last_event": event.get("recent_policy_last_event"),
    }

Analyst notes

Review recent_total_weakenings and recent_max_weakenings_per_hour for admin_email against baseline_total_weakenings - query Okta SystemLog for policy.rule.update and policy.lifecycle.update events by admin_email in the 24 hours around recent_policy_first_event, focusing on changedAttributes containing requireFactor=false or maxSessionLifetimeMinutes=0
Check recent_total_admin_enrollments and z_score_admin_enrollments for user.mfa.factor.activate events by admin_email in the 7 days around recent_enrollment_first_event - identify target accounts enrolled and verify whether enrollment was authorized and factor types are consistent with corporate standards
Search for Okta.ADAgent.TokenAbuse.Behavioral or other privileged account alerts for admin_email in the 48 hours before recent_policy_first_event to determine whether the admin account itself was compromised prior to the policy manipulation

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-03-17
Modified: 2026-03-17
Authored by: panther-labs
Source ID
Upstream: rules/okta_rules/okta_skeleton_key_bypass_behavioral.yml
Type: scheduled_rule
Version: 1
References: https://www.varonis.com/blog/okta-attack-vectors

ATT&CK

TA0003TA0005 T1098 T1556