Leveraging CrowdStrike Falcon Against Attacks Targeting Okta Environments

This report provides detection guidance for Okta-focused post-compromise activity, including identifying MFA push fatigue, persistence using the Okta Terrify toolkit, and abuse of delegate authority/Kerberos-based DesktopSSO. It includes concrete hunting queries, behavioral indicators (e.g., multiple auth_via_mfa events, enrollment ID anomalies, proof-of-possession usage), and a lower-fidelity user agent pattern to aid defenders in spotting suspicious authentication flows and attacker persistence.