Possible OneLogin User Assumed Another User (via onelogin.events)

title: Possible OneLogin User Assumed Another User (via onelogin.events)
id: fb586b25-072e-55e7-9bf0-d60774014ee0
status: stable
description: This rule detects when an user assumed another user account.
references:
    - https://developers.onelogin.com/api-docs/1/events/event-resource
author: Huntrule Team
date: 2026-01-29
tags:
    - attack.impact
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1078
logsource:
    product: onelogin
    service: onelogin.events
detection:
    selection:
        event_type_id: 3
    condition: selection
falsepositives:
    - Unknown
level: low