T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel

An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel — the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator's own infrastructure, typically a hosting or remote-desktop ASN rather than the user's network. This single-event rule keys on the tunnel classification Okta records in debug data; it is the observable tell of the relay. The fuller, higher-fidelity form is a baseline comparison — a session driven from an ASN the user has never authenticated from while the interaction pattern matches a relay — scored per user against 90 days of that user's own ASNs; the LogScale implementation of that scored version, keyed on new-ASN plus tunnel type plus factor operation, is published in the companion research. This rule is the portable, reputation-independent starting point: it does not depend on the domain, the kit, or prior knowledge of the campaign.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK techniques are exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1111	0	0	—
T1557 Adversary-in-the-Middle	4	0	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2025-31200	Apple / Multiple Products	0.186	—
CVE-2019-5591	Fortinet / FortiOS	0.184	ransomware
CVE-2025-31201	Apple / Multiple Products	0.139	—

Rule ID: 11fe9b88-e681-4c9c-bc20-6267631b20ca
Status: experimental
Level: medium
Log source: product: okta
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1111 , T1557 (signal rollup)
Canonical YAML: t1557-aitm-cross-asn-session-mfa.yml

References

False positives

Users who legitimately authenticate through a corporate VPN, a sanctioned proxy (for example Zscaler), or a VDI / remote-desktop gateway. Exclude the tunnel operators and ASNs your workforce genuinely uses; the anomaly worth keeping is a tunnel type or ASN the user has no history of. This exclusion is what the baselined LogScale version automates.
Contractors or remote staff reaching Okta over a personal VPN. Baseline per user before promoting past experimental.
Penetration tests and red-team exercises that route Okta authentication through proxy or Tor infrastructure. Correlate with authorized-testing windows.

Rule YAML

title: 'T1557 Okta Authentication or MFA via a Remote-Desktop / Proxy / Tor Tunnel'
id: '11fe9b88-e681-4c9c-bc20-6267631b20ca'
status: 'experimental'
description: 'An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel — the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator''s own infrastructure, typically a hosting or remote-desktop ASN rather than the user''s network. This single-event rule keys on the tunnel classification Okta records in debug data; it is the observable tell of the relay. The fuller, higher-fidelity form is a baseline comparison — a session driven from an ASN the user has never authenticated from while the interaction pattern matches a relay — scored per user against 90 days of that user''s own ASNs; the LogScale implementation of that scored version, keyed on new-ASN plus tunnel type plus factor operation, is published in the companion research. This rule is the portable, reputation-independent starting point: it does not depend on the domain, the kit, or prior knowledge of the campaign.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1111/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.t1111'
    - 'tlp.clear'
logsource:
    product: 'okta'
detection:
    selection_auth:
        eventType:
            - 'user.session.start'
            - 'user.authentication.auth_via_mfa'
            - 'user.authentication.verify'
    selection_relay_tunnel:
        debugContext.debugData.tunnels|contains:
            - 'REMOTE_DESKTOP'
            - '"type":"TOR"'
            - '"type":"PROXY"'
    condition: 'selection_auth and selection_relay_tunnel'
falsepositives:
    - 'Users who legitimately authenticate through a corporate VPN, a sanctioned proxy (for example Zscaler), or a VDI / remote-desktop gateway. Exclude the tunnel operators and ASNs your workforce genuinely uses; the anomaly worth keeping is a tunnel type or ASN the user has no history of. This exclusion is what the baselined LogScale version automates.'
    - 'Contractors or remote staff reaching Okta over a personal VPN. Baseline per user before promoting past experimental.'
    - 'Penetration tests and red-team exercises that route Okta authentication through proxy or Tor infrastructure. Correlate with authorized-testing windows.'
level: 'medium'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1557-aitm-cross-asn-session-mfa.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.