Okta anonymizing proxy sign-in
An Okta authentication event where Okta's security context flagged the client as coming through an anonymizing proxy or Tor.
What it detects
An Okta authentication event where Okta's security context flagged the client as coming through an anonymizing proxy or Tor. Attackers routinely hide behind proxies to evade geo/IP controls; a proxy sign-in against a corporate account deserves scrutiny, especially when paired with a new device or country.
MITRE ATT&CK mapping
- T1090.003Proxy: Multi-hop Proxy· Command and Control
False positives and triage
Legitimate users on corporate VPNs, some mobile carriers, and privacy tools can be flagged as proxies. Weigh alongside the country, the AS org, and whether the sign-in succeeded from an otherwise unseen location.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/okta_anonymizing_proxy_signin.yaml, licensed under the Apache License 2.0.
id: cloud.okta.anonymizing_proxy_signin
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1090.003]
description: |
An Okta authentication event where Okta's security context flagged the client as coming
through an anonymizing proxy or Tor. Attackers routinely hide behind proxies to evade
geo/IP controls; a proxy sign-in against a corporate account deserves scrutiny,
especially when paired with a new device or country.
match:
provider: Okta
event_category: authentication
raw_message_contains_any:
- "proxy=true"
correlation_keys: [user_name]
false_positive_guidance: |
Legitimate users on corporate VPNs, some mobile carriers, and privacy tools can be
flagged as proxies. Weigh alongside the country, the AS org, and whether the sign-in
succeeded from an otherwise unseen location.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.