Okta User Session Start from Anonymizing Proxy Service

Identifies Okta user session starts where the session is marked as using an anonymizing proxy.

FreeUnreviewedSigmahighv1

okta-user-session-start-from-anonymizing-proxy-service-bde30855

title: Okta User Session Start from Anonymizing Proxy Service
id: 106a9fd2-5c2d-4b7b-bd5b-7a0c54d34896
status: test
description: This rule flags Okta events where a user.session.start occurs and the session is marked as coming from an anonymising proxy service. Attackers may route activity through anonymizing infrastructure to reduce traceability and blend with legitimate proxy usage. The detection relies on Okta system log fields, specifically eventType user.session.start and securityContext.isProxy=true.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_user_session_start_via_anonymised_proxy.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: user.session.start
    securityContext.isProxy: "true"
  condition: selection
falsepositives:
  - If a user requires an anonymising proxy due to valid justifications.
level: high
license: DRL-1.1
related:
  - id: bde30855-5c53-4c18-ae90-1ff79ebc9578
    type: derived

What it detects

This rule flags Okta events where a user.session.start occurs and the session is marked as coming from an anonymising proxy service. Attackers may route activity through anonymizing infrastructure to reduce traceability and blend with legitimate proxy usage. The detection relies on Okta system log fields, specifically eventType user.session.start and securityContext.isProxy=true.

Known false positives

If a user requires an anonymising proxy due to valid justifications.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.