Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Using Purple Knight to Detect the Okta Super Admin Attack

semperis.com | vulnerability | #identity-security | #detection | #mfa | #okta | #purple-knight | #super-admin | #indicators

Summary

Semperis expanded Purple Knight to Okta with two indicators: new Super Admin grants in 7 days and users without MFA. They helped detect the recent Okta attacks, where elevated access disabled 2FA.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: AD Security News, June 2024
June 2024 roundup: attacks disrupted London hospitals, stolen credentials bypassed Okta to hit Snowflake customers, and Medibank's breach renewed lessons on enforcing MFA.
blog · semperis.com
Semperis Offers New Protection Against Okta Breaches
Semperis extended its identity protection platform to Okta. Explains Okta's IAM role, breach consequences (data theft, takeover, compliance issues), and why cloud IAM platforms need protection.
blog · semperis.com
Your Zero Trust Strategy Depends on Active Directory Integrity
Zero-trust and cloud IAM adoption (Azure AD, Okta) surged with remote work, but Semperis' Sean Deuby argues these strategies still depend on the integrity of on-premises Active Directory.
blog · semperis.com
Microsoft upends traditional password recommendations with significant new guidance
Microsoft's Password Guidance white paper, drawing on billions of Azure AD logins, advises dropping composition rules and periodic resets, keeping an 8-character minimum, and enforcing risk-based MFA.
blog · wiz.io
3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs
Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
back