LoFP / if a user requires an anonymising proxy due to valid justifications.

Techniques

• t1685

Sample rules

Okta User Session Start Via An Anonymising Proxy Service

• source: sigma
• technicques:
  • t1685

Description

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Detection logic

condition: selection
selection:
  eventType: user.session.start
  securityContext.isProxy: 'true'