Okta Session Impersonation Granted From Untrusted Domain

experimentalmedium

log source: okta · oktaauthor zendannyydate 2026-04-28

description

What this is, in brief.

Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session. This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account. Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user. Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.

rule source (YAML)

title: Okta Session Impersonation Granted From Untrusted Domain
id: fe04b26b-0ac4-45d7-9404-4b9f16a440a9
status: experimental
description: |
    Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.
    This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account.
    Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.
    Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.
references:
    - https://developer.okta.com/docs/reference/system-log-query/
    - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
    - https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For
author: zendannyy
date: 2026-04-28
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.002
    - attack.initial-access
    - attack.t1199
logsource:
    service: okta
    product: okta
detection:
    selection:
        eventType: 'user.session.impersonation.grant'
    filter_main_okta:
        actor.alternateId|contains: 'system@okta.com'
    filter_main_company:
        actor.alternateId|contains|expand: '%legtimate_identifiers%' # Your trusted domain goes here
    condition: selection and not 1 of filter_main_*
falsepositives:
    - The only legitimate use case here is an Okta support engineer actively working with an internal Okta Admin.
    - This access is temporary and should be revoked once done with the support case.
    - Apply additional filters if necessary
level: medium

detects techniques (2)

ATT&CK techniques this enables or maps to.

references

External citations — patches, advisories, analysis.