Analytics BIOC Informational

Okta User Session Impersonation

A user has initiated a session impersonation in Okta.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:
Identity Threat Detection (ITDR)
Data source:
Okta Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Trusted Relationship (T1199)
Detector tags: Okta Audit Analytics
Attacker's goals:

An attacker's goal is to gain unauthorized access to sensitive information or perform malicious actions on behalf of the impersonated user.

Investigative actions:

Ensure the user is authorized to impersonate a user session. Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Okta User Session Impersonation with suspicious characteristics Low (parent: Informational)