OneLogin User Assumed Another User

AnalysisType: rule
Filename: onelogin_user_assumed.py
RuleID: "OneLogin.UserAssumption"
DisplayName: "OneLogin User Assumed Another User"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Lateral Movement:Use Alternate Authentication Material
Reports:
  MITRE ATT&CK:
    - TA0008:T1550
Severity: Low
Description: User assumed another user account
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010594#:~:text=Prerequisites,Actions%20and%20select%20Assume%20User.
Runbook: >
  Investigate whether this was authorized access.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: User assumed their own account
    ExpectedResult: false
    Log:
      {
        "event_type_id": "240",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User assumed another user's account
    ExpectedResult: true
    Log:
      {
        "event_type_id": "3",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }