Sigma rule: Okta Session Impersonation Granted From Untrusted Domain

Rule

Title

Okta Session Impersonation Granted From Untrusted Domain

Status

experimental

Level

medium

Author

zendannyy

Date

2026-04-28

File

rules-placeholder/identity/okta/okta_session_impersonation_granted.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.
This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account.
Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.
Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

Log source

product

okta

service

okta

Detection

selection:
    eventType: 'user.session.impersonation.grant'
filter_main_okta:
    actor.alternateId|contains: '[email protected]'
filter_main_company:
    actor.alternateId|contains|expand: '%legtimate_identifiers%' # Your trusted domain goes here
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• The only legitimate use case here is an Okta support engineer actively working with an internal Okta Admin.
• This access is temporary and should be revoked once done with the support case.
• Apply additional filters if necessary

Tags

• attack.privilege-escalation
• attack.defense-impairment
• attack.t1484.002
• attack.initial-access
• attack.t1199

MITRE ATT&CK ids this rule names

• T1199
• T1484.002

References

• https://developer.okta.com/docs/reference/system-log-query/
• https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
• https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/identity/okta/okta_session_impersonation_granted.yml