Threat hunts for Okta

12 hunts

1. high Part 2 of 2

   Research by Cisco Talos

   SSO Takeover and Data Impact

   An adversary has bypassed SSO protections using stolen credentials and is now performing bulk data exfiltration or deploying ransomware across the environment.

   3 query1 analytic1 checkpoint1 action2 task

   credential access · execution · impact
2. high Part 1 of 2

   Research by Cisco Talos

   Infostealer execution and browser credential harvesting

   An adversary has successfully phished a user and executed an infostealer, which is now harvesting browser credentials and cookies from local SQLite databases for exfiltration.

   5 query2 analytic2 checkpoint1 action2 task

   credential access · execution · impact
3. high Part 2 of 2

   Research by The DFIR Report

   Bissa Scanner C2 and S3 Exfiltration

   An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers.

   3 query1 analytic1 checkpoint1 action2 task

   CVE-2025-55182 · CVE-2025-9501
4. high Part 1 of 2

   Research by The DFIR Report

   Bissa Scanner Mass Exploitation and Credential Harvesting

   An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities in Next.js or WordPress, then harvesting sensitive credentials from .env files and cloud metadata.

   3 query2 analytic2 checkpoint1 action2 task

   CVE-2025-55182 · CVE-2025-9501
5. high

   Research by Elastic Security Labs

   Rapid Phishing and Proxy-based Exfiltration

   An adversary has bypassed phishing-resistant MFA to gain initial access via a SaaS provider and is now using a multi-hop proxy or tunnel to exfiltrate data from an internal host.

   3 query2 analytic2 checkpoint1 action2 task

   command and control · exfiltration · initial access
6. medium

   Research by Red Canary

   Correlating Proxy-Obscured Identity and Endpoint Activity

   An adversary is using multi-hop proxy infrastructure to authenticate via Okta and subsequently execute discovery commands on an endpoint, obscured by network egress to proxy relay ports.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · execution · initial access
7. medium

   Research by Elastic Security Labs

   Endpoint-to-Cloud Phased Intrusion Hunt

   An adversary establishes a beachhead on an endpoint, moves laterally to obtain administrative access, and pivots to cloud services while maintaining C2 via a multi-hop proxy.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · credential access · execution
8. medium

   Research by Microsoft

   Managed Access and Tenant Integrity

   An adversary has established persistence via cross-tenant delegated administration or unattended remote support, subsequently deploying autonomous agents that communicate through multi-hop proxies.

   5 query2 analytic1 checkpoint1 action2 task

   command and control · execution · persistence
9. high Part 2 of 2

   Research by Unit 42

   Appliance Persistence and Identity Abuse

   An adversary has modified appliance scheduled tasks to disable MFA and is exfiltrating credentials via native Slack webhook integrations.

   3 query1 analytic1 checkpoint1 action2 task

   defense evasion · execution · exfiltration
10. high Part 1 of 2

    Research by Unit 42

    Collaboration Platform Phishing and Execution

    An intruder has compromised an enterprise identity using collaboration tools to bypass email-based controls and execute malicious code via sideloading or malicious dependencies.

    4 query2 analytic2 checkpoint1 action2 task

    defense evasion · execution · exfiltration
11. high

    Research by Elastic Security Labs

    Obfuscated Identity and Host Access

    An adversary is using multi-hop proxies or tunnels to mask their origin during authentication to cloud identity providers, subsequently using that access to reach internal hosts and execute local commands.

    5 query2 analytic1 checkpoint1 action2 task

    command and control · execution · initial access
12. high Part 2 of 2

    Research by Microsoft

    Microsoft Graph and Cloud Application Exfiltration

    An adversary is using automated Graph API tools to enumerate organizational resources and exfiltrate SharePoint/OneDrive data after obtaining a cloud session via passkey-themed social engineering.

    4 query1 analytic1 checkpoint1 action2 task

    discovery · exfiltration · initial access