Skip to content
Okta Forensics

This tool is not affiliated with, endorsed by or sponsored by Okta, Inc. Okta is a trademark of Okta, Inc. Other names are trademarks of their respective owners.

Posts tagged: #persistence

← Back to all posts
Okta Super Admin Role and API Token Abuse in the Logs
Find Okta admin role grants, API tokens, weakened policies and support impersonation in the System Log, and remove the persistence an attacker left behind.
oktaprivileged-accesspersistence
Okta Cross-Tenant Impersonation: Rogue IdP Persistence
How attackers add an inbound identity provider to an Okta org to sign in as any user, the System Log events that expose it, and how to remove the backdoor.
oktapersistenceprivileged-access

This tool is not affiliated with, endorsed by or sponsored by Okta, Inc. Okta is a trademark of Okta, Inc. Other names are trademarks of their respective owners.