Administrator Role Assigned to an Okta User

calendar Sep 25, 2024 · Data Source: Okta Use Case: Identity and Access Audit Tactic: Persistence  ·
Share on: linkedin copy

Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/11/06"
 3integration = ["okta"]
 4maturity = "production"
 5updated_date = "2024/09/23"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator
11role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's
12environment.
13"""
14false_positives = [
15    """
16    Administrator roles may be assigned to Okta users by a Super Admin user. Verify that the behavior was expected.
17    Exceptions can be added to this rule to filter expected behavior.
18    """,
19]
20index = ["filebeat-*", "logs-okta*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "Administrator Role Assigned to an Okta User"
24note = """## Setup
25
26The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
27references = [
28    "https://help.okta.com/en/prod/Content/Topics/Security/administrators-admin-comparison.htm",
29    "https://developer.okta.com/docs/reference/api/system-log/",
30    "https://developer.okta.com/docs/reference/api/event-types/",
31    "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy",
32    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
33    "https://www.elastic.co/security-labs/starter-guide-to-understanding-okta",
34    "https://www.elastic.co/security-labs/okta-and-lapsus-what-you-need-to-know",
35]
36risk_score = 47
37rule_id = "f06414a6-f2a4-466d-8eba-10f85e8abf71"
38severity = "medium"
39tags = ["Data Source: Okta", "Use Case: Identity and Access Audit", "Tactic: Persistence"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:okta.system and event.action:user.account.privilege.grant
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1098"
52name = "Account Manipulation"
53reference = "https://attack.mitre.org/techniques/T1098/"
54
55
56[rule.threat.tactic]
57id = "TA0003"
58name = "Persistence"
59reference = "https://attack.mitre.org/tactics/TA0003/"

Setup

The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

References

Related rules

to-top