Okta Admin Role Assignment Created via iam.resourceset.bindings.add
Detects creation of new admin role assignments in Okta when an IAM resource set binding is added.
FreeReviewedSigma · Medium · v4
- Product
- okta
- Service
- okta
- Author
- Nikita Khalimonenkov (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
What it detects
This rule flags Okta system-log events where an admin role assignment is created, indicated by an iam.resourceset.bindings.add event. Creating new role bindings can enable privilege escalation and may be used for persistence if an attacker obtains additional administrative permissions. It relies on Okta event telemetry, specifically the eventType field from the Okta System Log.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-admin-role-assignment-created-via-iam-resource-set-binding-add-139bdd4b
title: Okta Admin Role Assignment Created via iam.resourceset.bindings.add
id: 0aa69d11-fbcf-4322-a865-eb52b30b67bb
status: test
description: This rule flags Okta system-log events where an admin role assignment is created, indicated by an iam.resourceset.bindings.add event. Creating new role bindings can enable privilege escalation and may be used for persistence if an attacker obtains additional administrative permissions. It relies on Okta event telemetry, specifically the eventType field from the Okta System Log.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_role_assignment_created.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2023-01-19
modified: 2026-04-27
tags:
- attack.persistence
logsource:
product: okta
service: okta
detection:
selection:
eventType: iam.resourceset.bindings.add
condition: selection
falsepositives:
- Legitimate creation of a new admin role assignment
level: medium
license: DRL-1.1
related:
- id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c
type: derived