Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a user receives an Okta administrator role and then creates an Identity Provider connection.

Strategy

This rule monitors successful user.account.privilege.grant events that assign a Super Administrator or Organization Administrator role, followed by a successful system.idp.lifecycle.create event from the same user. This sequence can establish unauthorized control over authentication and access to connected applications.

Triage and response

• Confirm that the administrator role granted to {{@target.alternateId}} was authorized.
• Verify that {{@actor.alternateId}} created the Identity Provider connection for an approved business purpose.
• Review the new Identity Provider configuration, routing rules, signing certificates, and assigned users or groups.
• Examine authentication, session, IP address, user-agent, and administrative activity associated with the user.
• Disable unauthorized Identity Provider connections, revoke suspicious sessions, and reset affected credentials.