UNC6671 Multi-Brand Vishing Extortion: Okta-Themed AiTM Phishing Infrastructure — OTX Pulse Detection Pack

---
title: UNC6671 Okta-Themed AiTM Phishing Domain Resolution
id: 7f3a2c11-9e4b-4c2d-8a1f-unc6671dns01
status: experimental
description: Detects DNS queries to known UNC6671 vishing/AiTM credential-harvesting domains from the 2026-09 OTX pulse (Okta/passkey/SSO themed spoof portals)
author: Security Arsenal Threat Intel
date: 2026/09/06
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
logsource:
    category: dns
product: windows
    definition: 'Requirements: DNS query logging via DNS server debug log, ETW, or network sensor'
detection:
    selection_ioc:
        query|contains:
            - 'oktaenroll.com'
            - 'idokta.com'
            - 'myoktasso.com'
            - 'mypasskeysso.com'
            - 'setupssopasskey.com'
            - 'passkeyms.com'
            - 'keyokta.com'
            - 'portalpasskey.com'
    filter_internal:
        query|contains:
            - 'okta.com'
            - 'okta-emea.com'
            - 'oktacdn.com'
    condition: selection_ioc and not filter_internal
falsepositives:
    - Threat researcher sandbox detonation
level: high
tags:
    - attack.t1566.004
    - attack.t1557
    - attack.t1078
---
title: Suspicious IdP-Themed Lookalike Domain Resolution (Okta/SSO/Passkey Pattern)
id: 7f3a2c12-9e4b-4c2d-8a1f-unc6671ptrn
status: experimental
description: Detects DNS resolution of newly observed domains impersonating Okta, SSO, or passkey enrollment portals — catches UNC6671 infrastructure not yet in IOC feeds
author: Security Arsenal Threat Intel
date: 2026/09/06
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
logsource:
    category: dns
product: windows
    definition: 'Requirements: DNS query logging via DNS server debug log, ETW, or network sensor'
detection:
    selection_pattern:
        query|re: '(okta[a-z0-9-]*\.(?!okta\.com)|[a-z0-9-]*okta[a-z0-9-]*\.(?!okta\.com)|[a-z0-9-]*(sso|passkey)[a-z0-9-]*(enroll|setup|portal|ms)[a-z0-9-]*\.)[a-z]{2,}$'
    filter_legit:
        query|ends_with:
            - '.okta.com'
            - '.oktacdn.com'
            - '.okta-emea.com'
            - '.microsoftonline.com'
            - '.microsoft.com'
    condition: selection_pattern and not filter_legit
falsepositives:
    - Legitimate regional IdP vanity domains (tune with allowlist)
level: medium
tags:
    - attack.t1566.004
    - attack.t1557
---
title: Impossible-Travel Session Replay After Suspicious IdP Authentication
id: 7f3a2c13-9e4b-4c2d-8a1f-unc6671sess
status: experimental
description: Detects successful sign-in events where the same identity authenticates from a known-corporate ASN and a foreign/VPN ASN within a short window — indicative of AiTM session-token theft and replay by UNC6671
author: Security Arsenal Threat Intel
date: 2026/09/06
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
logsource:
    product: azure
    service: signinlogs
    definition: 'Requirements: Azure AD/Entra sign-in logs streamed to SIEM with ASN enrichment'
detection:
    selection:
        status: success
        auth_method|contains:
            - 'password'
            - 'otp'
    condition: selection
    timeframe: 30m
    aggregation:
        - field: userPrincipalName
          groupby: userPrincipalName
          condition: distinct_count(ip_asn) > 1
falsepositives:
    - User roaming onto mobile hotspot (correlate with helpdesk vishing reports and MFA factor change events)
level: high
tags:
    - attack.t1557
    - attack.t1078
    - attack.t1621

// UNC6671 Hunt: AiTM phishing domain access + post-compromise MFA factor manipulation
// Sentinel tables: DeviceNetworkEvents (DNS/proxy via Defender), AADSignInEventsBeta, AuditLogs

let LookalikeDomains = dynamic([
    "oktaenroll.com","idokta.com","myoktasso.com","mypasskeysso.com",
    "setupssopasskey.com","passkeyms.com","keyokta.com","portalpasskey.com"
]);
let IdPPattern = @"(okta|sso|passkey).*(enroll|setup|portal|key|ms)";

// Part 1: Endpoints reaching known or pattern-matched spoof domains
let DomainHits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl has_any (LookalikeDomains)
    or (RemoteUrl matches regex IdPPattern
        and not(RemoteUrl has_any ("okta.com","oktacdn.com","microsoftonline.com")))
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName;

// Part 2: MFA / auth-method changes on accounts that touched the domains
DomainHits
| summarize FirstSeen=min(TimeGenerated) by InitiatingProcessAccountName, RemoteUrl
| join kind=leftouter (
    AuditLogs
    | where TimeGenerated > ago(90d)
    | where OperationName has_any ("Update user","StrongAuthentication","Add service principal credentials","Consent to application")
    | mv-expand TargetResources
    | project OpTime=TimeGenerated, OperationName, InitiatedBy, TargetUser=tostring(TargetResources.userPrincipalName)
) on $left.InitiatingProcessAccountName == $right.TargetUser
| extend PostContactAction = iff(OpTime > FirstSeen and OpTime < FirstSeen + 1h, "LIKELY_HIJACK", "review")
| project FirstSeen, InitiatingProcessAccountName, RemoteUrl, OperationName, InitiatedBy, OpTime, PostContactAction
| order by FirstSeen desc

# UNC6671 AiTM Vishing Hunt — run on endpoints or export to a central share
# Checks: DNS cache for spoof domains, proxy/VPN sessions, browser IdP-session artifacts
$SpoofDomains = @(
    'oktaenroll.com','idokta.com','myoktasso.com','mypasskeysso.com',
    'setupssopasskey.com','passkeyms.com','keyokta.com','portalpasskey.com'
)
$Pattern = '(okta|sso|passkey).*(enroll|setup|portal|key|ms)'
$Results = [System.Collections.Generic.List[object]]::new()

# 1) DNS client cache hits
Get-DnsClientCache -ErrorAction SilentlyContinue | ForEach-Object {
    if (($SpoofDomains -contains $_.Entry) -or
        ($_.Entry -match $Pattern -and $_.Entry -notmatch 'okta\.com$|microsoftonline\.com$')) {
        $Results.Add([pscustomobject]@{Check='DNSCache'; Artifact=$_.Entry; Detail=$_.Data})
    }
}

# 2) Active connections to infrastructure resolving to spoof themes
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $ptr = (Resolve-DnsName -Name $_.RemoteAddress -Type PTR -ErrorAction Stop).NameHost
        if ($ptr -match $Pattern) {
            $Results.Add([pscustomobject]@{Check='NetConnection'; Artifact=$_.RemoteAddress; Detail=$ptr})
        }
    } catch {}
}

# 3) Browser history artifacts (Chrome/Edge) for spoof portal visits
$histPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($h in $histPaths) {
    if (Test-Path $h) {
        $tmp = Copy-Item $h -Destination "$env:TEMP\hist_$([guid]::NewGuid().Guid)" -PassThru -Force
        try {
            Add-Type -AssemblyName System.Data
            # lightweight string scrape instead of sqlite dependency
            $raw = [System.IO.File]::ReadAllBytes($tmp.FullName)
            $txt = [System.Text.Encoding]::UTF8.GetString($raw)
            foreach ($d in $SpoofDomains) {
                if ($txt -match [regex]::Escape($d)) {
                    $Results.Add([pscustomobject]@{Check='BrowserHistory'; Artifact=$d; Detail=$h})
                }
            }
        } finally { Remove-Item $tmp.FullName -Force -ErrorAction SilentlyContinue }
    }
}

# 4) Scheduled tasks / run keys referencing suspicious IdP-themed URLs (persistence check)
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
                 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match $Pattern -and $_.Value -notmatch 'okta\.com' } |
    ForEach-Object { $Results.Add([pscustomobject]@{Check='RunKey'; Artifact=$_.Name; Detail=$_.Value}) }

if ($Results.Count) {
    $Results | Format-Table -AutoSize
    $Results | Export-Csv "$env:TEMP\UNC6671_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
    Write-Warning "UNC6671 artifacts found — isolate host and force IdP session revocation + MFA re-enrollment."
} else {
    Write-Output "No UNC6671 indicators found on $env:COMPUTERNAME."
}