OneLogin Events: User Assumed Another User Account (event_type_id 3)

title: "OneLogin Events: User Assumed Another User Account (event_type_id 3)"
id: 3c333d0d-122e-4cab-8331-3f390d2a7008
status: test
description: This rule flags OneLogin event records where an authenticated user is associated with an account assumption action (event_type_id 3). Account assumption can be used to impersonate another user and access resources without the original user’s consent. The detection relies on OneLogin event telemetry containing event_type_id values for the relevant action.
references:
  - https://developers.onelogin.com/api-docs/1/events/event-resource
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/onelogin/onelogin_assumed_another_user.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-12
modified: 2022-12-25
tags:
  - attack.impact
logsource:
  product: onelogin
  service: onelogin.events
detection:
  selection:
    event_type_id: 3
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 62fff148-278d-497e-8ecd-ad6083231a35
    type: derived