T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel

An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel: the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator's own infrastructure, typically a hosting or remote-desktop ASN rather than the user's network. This single-event rule keys on the tunnel classification Okta records in debug data; it is the observable tell of the relay. The fuller, higher-fidelity form is a baseline comparison: a session driven from an ASN the user has never authenticated from while the interaction pattern matches a relay: scored per user against 90 days of that user's own ASNs; the LogScale implementation of that scored version, keyed on new-ASN plus tunnel type plus factor operation, is published in the companion research. This rule is the portable, reputation-independent starting point: it does not depend on the domain, the kit, or prior knowledge of the campaign.

Intel context

The techniques this rule covers are in use. This is the evidence for them as of November 7, 2026.

Technique	KEV CVEs	Research, 90d	Active families
T1111 Multi-Factor Authentication Interception	0	3	—
T1557 Adversary-in-the-Middle	4	7	—

KEV CVEs mapped to this technique

CVEs in CISA KEV that MITRE maps to this technique. They may belong to other campaigns. They show the technique is in use.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2025-31200	Apple / Multiple Products	0.209	—
CVE-2019-5591	Fortinet / FortiOS	0.186	ransomware
CVE-2025-31201	Apple / Multiple Products	0.140	—

Research citing this technique

2026-11-04 · ESET SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
2026-10-30 · Microsoft Threat Intelligence From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-29 · Cisco Talos IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 · Huntress M365 Token Spray and Replay Campaign Compromises Business Email Accounts
2026-09-02 · Huntress Inside Knight Office, a New M365 AiTM Phishing Kit
2026-08-25 · Group-IB Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
2026-08-19 · Group-IB Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Rule ID: 11fe9b88-e681-4c9c-bc20-6267631b20ca
Status: experimental
Level: medium
Log source: product: okta
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1111 , T1557 (signal rollup)
Canonical YAML: t1557-aitm-cross-asn-session-mfa.yml

References

False positives

Users who legitimately authenticate through a corporate VPN, a sanctioned proxy (for example Zscaler), or a VDI / remote-desktop gateway. Exclude the tunnel operators and ASNs your workforce genuinely uses; the anomaly worth keeping is a tunnel type or ASN the user has no history of. This exclusion is what the baselined LogScale version automates.
Contractors or remote staff reaching Okta over a personal VPN. Baseline per user before promoting past experimental.
Penetration tests and red-team exercises that route Okta authentication through proxy or Tor infrastructure. Correlate with authorized-testing windows.

Rule YAML

title: 'T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel'
id: '11fe9b88-e681-4c9c-bc20-6267631b20ca'
status: 'experimental'
description: 'An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel: the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator''s own infrastructure, typically a hosting or remote-desktop ASN rather than the user''s network. This single-event rule keys on the tunnel classification Okta records in debug data; it is the observable tell of the relay. The fuller, higher-fidelity form is a baseline comparison: a session driven from an ASN the user has never authenticated from while the interaction pattern matches a relay: scored per user against 90 days of that user''s own ASNs; the LogScale implementation of that scored version, keyed on new-ASN plus tunnel type plus factor operation, is published in the companion research. This rule is the portable, reputation-independent starting point: it does not depend on the domain, the kit, or prior knowledge of the campaign.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1111/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.t1111'
    - 'tlp.clear'
logsource:
    product: 'okta'
detection:
    selection_auth:
        eventType:
            - 'user.session.start'
            - 'user.authentication.auth_via_mfa'
            - 'user.authentication.verify'
    selection_relay_tunnel:
        debugContext.debugData.tunnels|contains:
            - 'REMOTE_DESKTOP'
            - '"type":"TOR"'
            - '"type":"PROXY"'
    condition: 'selection_auth and selection_relay_tunnel'
falsepositives:
    - 'Users who legitimately authenticate through a corporate VPN, a sanctioned proxy (for example Zscaler), or a VDI / remote-desktop gateway. Exclude the tunnel operators and ASNs your workforce genuinely uses; the anomaly worth keeping is a tunnel type or ASN the user has no history of. This exclusion is what the baselined LogScale version automates.'
    - 'Contractors or remote staff reaching Okta over a personal VPN. Baseline per user before promoting past experimental.'
    - 'Penetration tests and red-team exercises that route Okta authentication through proxy or Tor infrastructure. Correlate with authorized-testing windows.'
level: 'medium'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1557-aitm-cross-asn-session-mfa.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.