Okta admin function access via proxy (requestUri contains admin and isProxy enabled)
Flags Okta requests targeting admin URIs when the event indicates the traffic is proxied.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Muhammad Faisal @faisalusuf (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
What it detects
This rule flags Okta activity where the request URI contains the string "admin" while the request is marked as coming through a proxy. Such access can be used by attackers to reach privileged administrative endpoints while routing traffic through intermediary infrastructure. It relies on Okta telemetry fields for the requested URI and a proxy indicator to identify these events.
Reporting behind it
- beyondtrust.comhttps://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- dataconomy.comhttps://dataconomy.com/2023/10/23/okta-data-breach/
- blog.cloudflare.comhttps://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_activity_from_proxy_query.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-admin-function-access-via-proxy-9058ca8b
title: Okta admin function access via proxy (requestUri contains admin and isProxy enabled)
id: 46c10404-5e55-41a4-922d-114aa3494891
status: test
description: This rule flags Okta activity where the request URI contains the string "admin" while the request is marked as coming through a proxy. Such access can be used by attackers to reach privileged administrative endpoints while routing traffic through intermediary infrastructure. It relies on Okta telemetry fields for the requested URI and a proxy indicator to identify these events.
references:
- https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- https://dataconomy.com/2023/10/23/okta-data-breach/
- https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_activity_from_proxy_query.yml
author: Muhammad Faisal @faisalusuf, Huntrule Team
date: 2023-10-25
tags:
- attack.credential-access
logsource:
service: okta
product: okta
detection:
selection:
debugContext.debugData.requestUri|contains: admin
securityContext.isProxy: "true"
condition: selection
falsepositives:
- False positives are expected if administrators access these function through proxy legitimatly. Apply additional filters if necessary
level: medium
license: DRL-1.1
related:
- id: 9058ca8b-f397-4fd1-a9fa-2b7aad4d6309
type: derived