LoFP / administrator roles may be assigned to okta users by a super admin user. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1098

Sample rules

Administrator Privileges Assigned to an Okta Group

• source: elastic
• technicques:
  • T1098

Description

Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization.

Detection logic

event.dataset:okta.system and event.action:group.privilege.grant