OneLogin User Account Lock or Suspension via API Events

Flags OneLogin API events indicating a user account was locked or suspended.

FreeUnreviewedSigmalowv1

onelogin-user-account-lock-or-suspension-via-api-events-a717c561

title: OneLogin User Account Lock or Suspension via API Events
id: ccdf5878-3b1b-4eb7-ac1f-bd2bc3a0a432
status: test
description: This rule identifies OneLogin events where a user account is locked or suspended through API actions. Such changes can be part of attacker-driven account disruption or response to suspected compromise, making it important to monitor account status changes. It relies on OneLogin event notifications that match specific event type IDs corresponding to lock and suspend operations.
references:
  - https://developers.onelogin.com/api-docs/1/events/event-resource/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/onelogin/onelogin_user_account_locked.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-12
modified: 2022-12-25
tags:
  - attack.impact
logsource:
  product: onelogin
  service: onelogin.events
detection:
  selection1:
    event_type_id: 532
  selection2:
    event_type_id: 553
  selection3:
    event_type_id: 551
  condition: 1 of selection*
falsepositives:
  - System may lock or suspend user accounts.
level: low
license: DRL-1.1
related:
  - id: a717c561-d117-437e-b2d9-0118a7035d01
    type: derived

What it detects

This rule identifies OneLogin events where a user account is locked or suspended through API actions. Such changes can be part of attacker-driven account disruption or response to suspected compromise, making it important to monitor account status changes. It relies on OneLogin event notifications that match specific event type IDs corresponding to lock and suspend operations.

Known false positives

System may lock or suspend user accounts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.