Okta: New or Positive Admin Console access heuristics via policy.evaluate_sign_on

title: "Okta: New or Positive Admin Console access heuristics via policy.evaluate_sign_on"
id: 459f5628-1722-49fb-8390-81efef625531
status: test
description: This rule flags Okta sessions where policy evaluation indicates the target is the Okta Admin Console and the associated debug data is marked with POSITIVE heuristics. Attackers may attempt to access or establish activity in administrative workflows, and anomalous or newly identified behavior can be an early indicator of misuse. It relies on Okta system log events with eventType policy.evaluate_sign_on plus debugContext.debugData fields containing POSITIVE markers.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_new_behaviours_admin_console.yml
author: kelnage, Huntrule Team
date: 2023-09-07
modified: 2026-04-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: okta
  service: okta
detection:
  selection_event:
    eventType: policy.evaluate_sign_on
    target.displayName: Okta Admin Console
  selection_positive:
    - debugContext.debugData.behaviors|contains: POSITIVE
    - debugContext.debugData.logOnlySecurityData|contains: POSITIVE
  condition: all of selection_*
falsepositives:
  - When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual.
level: high
license: DRL-1.1
related:
  - id: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9
    type: derived