Okta Session Impersonation Granted From Untrusted Domain

SIGMA detection rule by zendannyy · NOASSERTION

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session. This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account. Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user. Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

title: Okta Session Impersonation Granted From Untrusted Domain
id: fe04b26b-0ac4-45d7-9404-4b9f16a440a9
status: experimental
description: |
    Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.
    This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account.
    Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.
    Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.
references:
    - https://developer.okta.com/docs/reference/system-log-query/
    - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
    - https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For
author: zendannyy
date: 2026-04-28
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.002
    - attack.initial-access
    - attack.t1199
logsource:
    service: okta
    product: okta
detection:
    selection:
        eventType: 'user.session.impersonation.grant'
    filter_main_okta:
        actor.alternateId|contains: 'system@okta.com'
    filter_main_company:
        actor.alternateId|contains|expand: '%legtimate_identifiers%' # Your trusted domain goes here
    condition: selection and not 1 of filter_main_*
falsepositives:
    - The only legitimate use case here is an Okta support engineer actively working with an internal Okta Admin.
    - This access is temporary and should be revoked once done with the support case.
    - Apply additional filters if necessary
level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

21e8e6f0-7e5a-4dd5-9a3a-42c4566f6fd3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion