Elastic medium stable kql

Okta User Assigned Administrator Role

Identifies when an administrator role is assigned to an Okta user or group. Adversaries may assign administrator privileges to compromised accounts to establish persistence, escalate privileges, and maintain long-term access to the environment. This detection monitors for both user-level and group-level administrator privilege grants, which can be used to bypass security controls and perform unauthorized administrative actions.

View Source

Detection Logic

data_stream.dataset:okta.system
    and event.action: (user.account.privilege.grant or group.privilege.grant)
    and okta.debug_context.debug_data.flattened.privilegeGranted: *administrator*

False Positives

⚠ Administrator roles may be assigned to Okta users or groups by authorized Super Admin users during normal IT operations such as onboarding, role changes, or organizational restructuring. Verify that the behavior was expected and authorized. Exceptions can be added to this rule to filter known administrators, service accounts, or automated provisioning systems.

Field Validations

Loading…

Comments (0)

Loading comments...