Okta User Session Start Via An Anonymising Proxy Service

Title: Okta User Session Start Via An Anonymising Proxy Service
Status: test
Description:Detects when an Okta user session starts where the user is behind an anonymising proxy service.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
Author: kelnage
Date: 2023-09-07
modified:2026-04-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    eventType: 'user.session.start'
    securityContext.isProxy: 'true'
  condition:selection
Falsepositives:
  -If a user requires an anonymising proxy due to valid justifications.
Level: high