huntrule

Okta Admin Role Assignment Created via IAM Resource Set Binding Add

Detects creation of new admin role assignments in Okta when an IAM resource set binding is added.

FreeUnreviewedSigmamediumv1
title: Okta Admin Role Assignment Created via IAM Resource Set Binding Add
id: 0aa69d11-fbcf-4322-a865-eb52b30b67bb
status: test
description: This rule flags Okta events where an IAM resource set binding is added for an admin role assignment. Creating new admin role assignments can enable privilege escalation or provide persistence for a malicious actor. The detection relies on Okta System Log eventType matching for iam.resourceset.bindings.add and records the corresponding role assignment creation activity.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_role_assignment_created.yml
author: Nikita Khalimonenkov, Huntrule Team
date: 2023-01-19
modified: 2026-04-27
tags:
  - attack.persistence
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType: iam.resourceset.bindings.add
  condition: selection
falsepositives:
  - Legitimate creation of a new admin role assignment
level: medium
license: DRL-1.1
related:
  - id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c
    type: derived

What it detects

This rule flags Okta events where an IAM resource set binding is added for an admin role assignment. Creating new admin role assignments can enable privilege escalation or provide persistence for a malicious actor. The detection relies on Okta System Log eventType matching for iam.resourceset.bindings.add and records the corresponding role assignment creation activity.

Known false positives

  • Legitimate creation of a new admin role assignment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.