Administrator Role Assigned to an Okta User

calendar Oct 24, 2023 · Data Source: Okta Use Case: Identity and Access Audit Tactic: Persistence  ·
Share on: linkedin copy

Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/06"
 3integration = ["okta"]
 4maturity = "production"
 5min_stack_comments = "Breaking change in Okta integration bumping version to ^2.0.0"
 6min_stack_version = "8.10.0"
 7updated_date = "2023/10/24"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator
13role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's
14environment.
15"""
16false_positives = [
17    """
18    Administrator roles may be assigned to Okta users by a Super Admin user. Verify that the behavior was expected.
19    Exceptions can be added to this rule to filter expected behavior.
20    """,
21]
22index = ["filebeat-*", "logs-okta*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Administrator Role Assigned to an Okta User"
26note = """## Setup
27
28The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = [
30    "https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm",
31    "https://developer.okta.com/docs/reference/api/system-log/",
32    "https://developer.okta.com/docs/reference/api/event-types/",
33    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
34]
35risk_score = 47
36rule_id = "f06414a6-f2a4-466d-8eba-10f85e8abf71"
37severity = "medium"
38tags = ["Data Source: Okta", "Use Case: Identity and Access Audit", "Tactic: Persistence"]
39timestamp_override = "event.ingested"
40type = "query"
41
42query = '''
43event.dataset:okta.system and event.action:user.account.privilege.grant
44'''
45
46
47[[rule.threat]]
48framework = "MITRE ATT&CK"
49[[rule.threat.technique]]
50id = "T1098"
51name = "Account Manipulation"
52reference = "https://attack.mitre.org/techniques/T1098/"
53
54
55[rule.threat.tactic]
56id = "TA0003"
57name = "Persistence"
58reference = "https://attack.mitre.org/tactics/TA0003/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top