Okta Admin Function Access via Proxy

Flags Okta requests targeting admin URIs when the event indicates the traffic is proxied.

FreeUnreviewedSigmamediumv1

okta-admin-function-access-via-proxy-9058ca8b

title: Okta Admin Function Access via Proxy
id: 46c10404-5e55-41a4-922d-114aa3494891
status: test
description: This rule identifies Okta service events where an HTTP request URI contains the string "admin" and the request is marked as originating through a proxy. Attackers may use proxying to hide their source while attempting to reach administrative functionality. The detection relies on Okta telemetry fields for the request URI and a proxy indicator.
references:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
  - https://dataconomy.com/2023/10/23/okta-data-breach/
  - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_activity_from_proxy_query.yml
author: Muhammad Faisal @faisalusuf, Huntrule Team
date: 2023-10-25
tags:
  - attack.credential-access
logsource:
  service: okta
  product: okta
detection:
  selection:
    debugContext.debugData.requestUri|contains: admin
    securityContext.isProxy: "true"
  condition: selection
falsepositives:
  - False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary
level: medium
license: DRL-1.1
related:
  - id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309
    type: derived

What it detects

This rule identifies Okta service events where an HTTP request URI contains the string "admin" and the request is marked as originating through a proxy. Attackers may use proxying to hide their source while attempting to reach administrative functionality. The detection relies on Okta telemetry fields for the request URI and a proxy indicator.

Known false positives

False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.