LoFP / administrator roles may be assigned to okta users by a super admin user. verify that the behavior was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1098

Sample rules

Administrator Role Assigned to an Okta User

• source: elastic
• technicques:
  • T1098

Description

Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target’s environment.

Detection logic

event.dataset:okta.system and event.action:user.account.privilege.grant

Administrator Privileges Assigned to an Okta Group

• source: elastic
• technicques:
  • T1098

Description

Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization.

Detection logic

event.dataset:okta.system and event.action:group.privilege.grant