Okta Admin Role Assigned to an User or Group

Title: Okta Admin Role Assigned to an User or Group
Status: test
Description:Detects when an the Administrator role is assigned to an user or group.
References:
  -https://developer.okta.com/docs/reference/api/system-log/
  -https://developer.okta.com/docs/reference/api/event-types/
Author: Austin Songer @austinsonger
Date: 2021-09-12
modified:2026-04-27
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098.003'

Logsource:

• product: okta
• service: okta

Detection:
  selection:
    eventType:
      -'group.privilege.grant'
      -'user.account.privilege.grant'

  condition:selection
Falsepositives:
  -Administrator roles could be assigned to users or group by other admin users.
Level: medium