Suspicious Okta Admin Functions Access Through Proxy (via okta)

title: Suspicious Okta Admin Functions Access Through Proxy (via okta)
id: 7e41dec6-fbbf-529c-adbe-0bf93988b58b
status: stable
description: This rule detects access to Okta admin functions through proxy.
references:
    - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
    - https://dataconomy.com/2023/10/23/okta-data-breach/
    - https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
author: Huntrule Team
date: 2026-07-22
tags:
    - attack.credential-access
    - attack.defense-evasion
    - attack.command-and-control
    - attack.persistence
    - attack.t1078.004
    - attack.t1090
logsource:
    service: okta
    product: okta
detection:
    selection:
        debugContext.debugData.requestUri|contains: 'admin'
        securityContext.isProxy: 'true'
    condition: selection
falsepositives:
    - Unknown
level: medium