title: 'T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel'
id: '11fe9b88-e681-4c9c-bc20-6267631b20ca'
status: 'experimental'
description: 'An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel — the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator''s own infrastructure, typically a hosting or remote-desktop ASN rather than the user''s network. This single-event rule keys on the tunnel classification Okta records in debug data; it is the observable tell of the relay. The fuller, higher-fidelity form is a baseline comparison — a session driven from an ASN the user has never authenticated from while the interaction pattern matches a relay — scored per user against 90 days of that user''s own ASNs; the LogScale implementation of that scored version, keyed on new-ASN plus tunnel type plus factor operation, is published in the companion research. This rule is the portable, reputation-independent starting point: it does not depend on the domain, the kit, or prior knowledge of the campaign.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1111/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.t1111'
    - 'tlp.clear'
logsource:
    product: 'okta'
detection:
    selection_auth:
        eventType:
            - 'user.session.start'
            - 'user.authentication.auth_via_mfa'
            - 'user.authentication.verify'
    selection_relay_tunnel:
        debugContext.debugData.tunnels|contains:
            - 'REMOTE_DESKTOP'
            - '"type":"TOR"'
            - '"type":"PROXY"'
    condition: 'selection_auth and selection_relay_tunnel'
falsepositives:
    - 'Users who legitimately authenticate through a corporate VPN, a sanctioned proxy (for example Zscaler), or a VDI / remote-desktop gateway. Exclude the tunnel operators and ASNs your workforce genuinely uses; the anomaly worth keeping is a tunnel type or ASN the user has no history of. This exclusion is what the baselined LogScale version automates.'
    - 'Contractors or remote staff reaching Okta over a personal VPN. Baseline per user before promoting past experimental.'
    - 'Penetration tests and red-team exercises that route Okta authentication through proxy or Tor infrastructure. Correlate with authorized-testing windows.'
level: 'medium'