Analytics BIOC
Informational
✕
Okta User Session Impersonation
A user has initiated a session impersonation in Okta.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Okta Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Trusted Relationship (T1199)
Detector tags: Okta Audit Analytics
Attacker's goals:
An attacker's goal is to gain unauthorized access to sensitive information or perform malicious actions on behalf of the impersonated user.
Investigative actions:
Ensure the user is authorized to impersonate a user session. Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Okta User Session Impersonation with suspicious characteristics Low (parent: Informational)