Okta Admin Role Granted to User or Group

Flags Okta privilege grant events that assign Administrator permissions to a user or group.

FreeReviewedSigma · Medium · v4

Product: okta
Service: okta
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-09-12
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098.003Additional Cloud Roles
Priv Esc
- T1098.003Additional Cloud Roles
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Okta events where an Administrator role is granted to either a user or a group. Assigning privileged roles is a common persistence and privilege-escalation technique, enabling an attacker to retain elevated access even after other access changes. It relies on Okta System Log events indicating privilege grants for users and groups.

Reporting behind it

Related detections9 linkedT1098.003 — drag to rearrange

Suspicious MURKY PANDA Mail Permission Grant to Service Principal (via azure)

Malicious Assignment of a Privileged Azure AD Role (via auditlogs)

Suspicious Entra Cross-Tenant Access or External User Invitation via Azure Audit (via azure)

Suspicious Delegated Permission Grant to Entra Agent Access Scope via Azure Audit Logs

Suspicious IAM CreateLoginProfile For Root User via AWS AssumeRoot Abuse

Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy

Suspicious Member Added to Privileged Directory Role in Entra ID

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

GCP Google Workspace: Application ContextAwareAccess Setting Changed

Okta Admin Role Granted to User or Group

Pivot detection · T1098.003 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

okta-administrator-privilege-granted-to-user-or-group-413d4a81

title: Okta Admin Role Granted to User or Group
id: 03a8f378-fd26-432e-8203-f8c8876ae13d
status: test
description: This rule identifies Okta events where an Administrator role is granted to either a user or a group. Assigning privileged roles is a common persistence and privilege-escalation technique, enabling an attacker to retain elevated access even after other access changes. It relies on Okta System Log events indicating privilege grants for users and groups.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_admin_role_assigned_to_user_or_group.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098.003
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - group.privilege.grant
      - user.account.privilege.grant
  condition: selection
falsepositives:
  - Administrator roles could be assigned to users or group by other admin users.
level: medium
license: DRL-1.1
related:
  - id: 413d4a81-6c98-4479-9863-014785fd579c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL