New-Device Okta Sign-In Followed by Cross-Context Admin Console Auth Failures
Detects a new-device Okta sign-in followed by three or more failed Admin Console authentication attempts originating from a different device/IP context, consistent with privilege escalation using a stolen AiTM session token.
Microsoft Sentinel (KQL)
