Analytics BIOC
Informational
✕
Okta admin privilege assignment
A user assigned admin privileges to a new user or group.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Okta Audit Log
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Account Manipulation: Additional Cloud Credentials (T1098.001)
Detector tags: Okta Audit Analytics
Attacker's goals:
An attacker is attempting to gain access to sensitive information or systems, while privilege escalation involves their attempt to increase control and access within the system or network.
Investigative actions:
Reach out to the user responsible for the alert to confirm the legitimacy of the activity. Examine the user's actions preceding and following the activation of the alert. Analyze the actions carried out by the user responsible for granting permission.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Abnormal Okta admin privilege assignment with suspicious characteristics Low (parent: Informational)