📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥
summary
Okta shows 1,081 event types but useful hunting focuses on authentication and policy evaluation events; look for sessionId and dthash fields plus debugContext to link devices and sessions. Recent campaigns use Render and free hosting, reuse phishing kits, run low‑and‑slow and low‑medium sophistication attacks (Shiny Hunters style) to pivot into Salesforce, Atlassian, Slack, DocuSign, Google Workspace and M365. Audit sign‑in policies (priority 1–99), require phishing‑resistant MFA and MDM, deploy URLScan/VirusTotal monitoring, use Okta customer detections and continuous tailored hunt queries; FastPass failures reveal phishing infrastructure roughly half the time.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:02Octa usage and logging
- 4:12Recent Octa attack trends
- 9:05Threat hunting Octa compromise
- 12:53Policy and device management
- 15:39Threat hunting resources
- 17:25FastPass and fishing infrastructure
- 19:48Q&A and closing
related talks
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
42mIt’s Getting Real & Hitting the Fan 2023 Edition (Real World SaaS Attacks)
49mBeyond Takeover: Attacker’s in. Now what?
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
26mTechnical Tracks
32mHow to Orchestrate a Cyber Security Incident Tabletop Exercise
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures