Last reviewed:
Sigma rule outputs from CloudSigma rendered into Splunk queries against the Okta System Log schema. Every rule is mapped to MITRE ATT&CK and validated against its dialect.
| Technique | Rule | Severity | Log source |
|---|---|---|---|
| T1078 | Valid Accounts on Okta System Log | medium | Okta System Log |
| T1078 | Valid Accounts on Okta System Log | medium | Okta System Log |
| T1078.004 | Valid Accounts: Cloud Accounts on Okta System Log | medium | Okta System Log |
| T1098 | Account Manipulation on Okta System Log | medium | Okta System Log |
| T1098 | Account Manipulation on Okta System Log | medium | Okta System Log |
| T1098 | Account Manipulation on Okta System Log | medium | Okta System Log |
| T1528 | Steal Application Access Token on Okta System Log | medium | Okta System Log |
Okta Admin Role Assignment, generated by CloudSigma and validated against the Splunk dialect.
title: Okta Admin Role Assignment
id: 478d1624-f385-4bfe-9181-d184b59c7fc1
status: test
description: >
Detects assignment of administrative privileges in Okta. Attackers with
access to an Okta account may escalate privileges by granting admin
roles to compromised or attacker-controlled accounts.
author: CloudSigma
date: 2026-02-09
references:
- https://attack.mitre.org/techniques/T1098/
- https://developer.okta.com/docs/reference/api/system-log/
tags:
- attack.persistence
- attack.t1098
logsource:
product: okta
service: okta
detection:
selection:
eventType:
- user.account.privilege.grant
- group.privilege.grant
outcome.result: SUCCESS
condition: selection
falsepositives:
- Legitimate admin onboarding new IT staff
- Scheduled role rotation by identity governance team
level: high