Use Case: Privileged Access Detection

High Command Line Entropy Detected for Privileged Commands

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusually high median command line entropy for privileged commands executed by a user, suggesting possible privileged access activity through command lines. High entropy often indicates that the commands may be obfuscated or deliberately complex, which can be a sign of suspicious or unauthorized use of privileged access.

Spike in Group Application Assignment Change Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusual spike in Okta group application assignment change events, indicating potential privileged access activity. Threat actors might be assigning applications to groups to escalate access, maintain persistence, or facilitate lateral movement within an organization’s environment.

Spike in Group Lifecycle Change Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusual spike in Okta group lifecycle change events, indicating potential privileged access activity. Adversaries may be altering group structures to escalate privileges, maintain persistence, or facilitate lateral movement within an organization’s identity management system.

Spike in Group Management Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a spike in group management events for a user, indicating potential privileged access activity. The machine learning has flagged an abnormal rise in group management actions (such as adding or removing users from privileged groups), which could point to an attempt to escalate privileges or unauthorized modifications to group memberships.

Spike in Group Membership Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusual spike in Okta group membership events, indicating potential privileged access activity. Attackers or malicious insiders might be adding accounts to privileged groups to escalate their access, potentially leading to unauthorized actions or data breaches.

Spike in Group Privilege Change Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusual spike in Okta group privilege change events, indicating potential privileged access activity. Attackers might be elevating privileges by adding themselves or compromised accounts to high-privilege groups, enabling further access or persistence.

Spike in Privileged Command Execution by a User

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected an increase in the execution of privileged commands by a user, suggesting potential privileged access activity. This may indicate an attempt by the user to gain unauthorized access to sensitive or restricted parts of the system.

Spike in Special Logon Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected a surge in special logon events for a user, indicating potential privileged access activity. A sudden spike in these events could suggest an attacker or malicious insider gaining elevated access, possibly for lateral movement or privilege escalation.

Spike in Special Privilege Use Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected an unusual increase in special privilege usage events, such as privileged operations and service calls, for a user, suggesting potential unauthorized privileged access. A sudden spike in these events may indicate an attempt to escalate privileges, execute unauthorized tasks, or maintain persistence within a system.

Spike in User Account Management Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a spike in user account management events for a user, indicating potential privileged access activity. This indicates an unusual increase in actions related to managing user accounts (such as creating, modifying, or deleting accounts), which could be a sign of an attempt to escalate privileges or unauthorized activity involving account management.

Spike in User Lifecycle Management Change Events

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified an unusual spike in Okta user lifecycle management change events, indicating potential privileged access activity. Threat actors may manipulate user accounts to gain higher access rights or persist within the environment.

Unusual Group Name Accessed by a User

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected a user accessing an uncommon group name for privileged operations, indicating potential privileged access activity. This indicates that a user has accessed a group name that is unusual for their typical operations, particularly for actions requiring elevated privileges. This could point to an attempt to manipulate group memberships or escalate privileges on a system.

Unusual Host Name for Okta Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Okta from an uncommon device, indicating potential privileged access activity. This could signal a compromised account, an attacker using stolen credentials, or an insider threat leveraging an unauthorized device to escalate privileges.

Unusual Host Name for Windows Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Windows from an uncommon device, indicating potential privileged access activity. This could signal a compromised account, an attacker using stolen credentials, or an insider threat leveraging an unauthorized device to escalate privileges.

Unusual Privilege Type assigned to a User

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user leveraging an uncommon privilege type for privileged operations, indicating potential privileged access activity. This indicates that a user is performing operations requiring elevated privileges but is using a privilege type that is not typically seen in their baseline logs.

Unusual Process Detected for Privileged Commands by a User

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected an unusual process run for privileged commands by a user, indicating potential privileged access activity.

Unusual Region Name for Okta Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Okta from an uncommon geographical location, indicating potential privileged access activity. This could suggest a compromised account, unauthorized access, or an attacker using stolen credentials to escalate privileges.

Unusual Region Name for Windows Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Windows from an uncommon geographical location, indicating potential privileged access activity. This could suggest a compromised account, unauthorized access, or an attacker using stolen credentials to escalate privileges.

Unusual Source IP for Okta Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Okta from an uncommon source IP, indicating potential privileged access activity. This could suggest an account compromise, misuse of administrative privileges, or an attacker leveraging a new network location to escalate privileges.

Unusual Source IP for Windows Privileged Operations Detected

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has identified a user performing privileged operations in Windows from an uncommon source IP, indicating potential privileged access activity. This could suggest an account compromise, misuse of administrative privileges, or an attacker leveraging a new network location to escalate privileges.

Unusual Spike in Concurrent Active Sessions by a User

Jul 7, 2025 · Use Case: Privileged Access Detection Rule Type: ML Rule Type: Machine Learning Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

A machine learning job has detected an unusually high number of active concurrent sessions initiated by a user, indicating potential privileged access activity. A sudden surge in concurrent active sessions by a user may indicate an attempt to abuse valid credentials for privilege escalation or maintain persistence. Adversaries might be leveraging multiple sessions to execute privileged operations, evade detection, or perform unauthorized actions across different systems.