Okta Administrator Privilege Granted to User or Group

Flags Okta privilege grant events that assign Administrator permissions to a user or group.

FreeUnreviewedSigmamediumv1

okta-administrator-privilege-granted-to-user-or-group-413d4a81

title: Okta Administrator Privilege Granted to User or Group
id: 03a8f378-fd26-432e-8203-f8c8876ae13d
status: test
description: This rule identifies Okta events where the Administrator role is granted to either a specific user or a group. Assigning high-privilege roles is a common tactic for privilege escalation and long-term persistence. It relies on Okta System Log events indicating privilege grants, specifically group.privilege.grant and user.account.privilege.grant.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_role_assigned_to_user_or_group.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098.003
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - group.privilege.grant
      - user.account.privilege.grant
  condition: selection
falsepositives:
  - Administrator roles could be assigned to users or group by other admin users.
level: medium
license: DRL-1.1
related:
  - id: 413d4a81-6c98-4479-9863-014785fd579c
    type: derived

What it detects

This rule identifies Okta events where the Administrator role is granted to either a specific user or a group. Assigning high-privilege roles is a common tactic for privilege escalation and long-term persistence. It relies on Okta System Log events indicating privilege grants, specifically group.privilege.grant and user.account.privilege.grant.

Known false positives

Administrator roles could be assigned to users or group by other admin users.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.