Detection rules › Sigma
Okta New Admin Console Behaviours
Detects when Okta identifies new activity in the Admin Console.
Known false positives
- When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Okta | System Log event type policy.evaluate_sign_on: Sign-on policy evaluated |
Rules detecting the same action
These rules filter on the same operation.
- High-Risk Admin Activity (Kusto)
- Okta AiTM Session Cookie Replay (Elastic)
- Okta Multiple Failed Requests To Access Applications (YARA-L)
- Okta Multiple Failed Requests to Access Applications (Splunk)
- Okta New Behaviors Acessing Admin Console (Panther)
- Okta Suspicious Use Of A Session Cookie (YARA-L)
- Okta Suspicious Use of a Session Cookie (Splunk)
Rule body
title: Okta New Admin Console Behaviours
id: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9
status: test
description: Detects when Okta identifies new activity in the Admin Console.
references:
- https://developer.okta.com/docs/reference/api/system-log/
- https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
author: kelnage
date: 2023-09-07
modified: 2026-04-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078.004
logsource:
product: okta
service: okta
detection:
selection_event:
eventType: 'policy.evaluate_sign_on'
target.displayName: 'Okta Admin Console'
selection_positive:
- debugContext.debugData.behaviors|contains: 'POSITIVE'
- debugContext.debugData.logOnlySecurityData|contains: 'POSITIVE'
condition: all of selection_*
falsepositives:
- When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual.
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_event
selection_event:
eventType: 'policy.evaluate_sign_on'
target.displayName: 'Okta Admin Console'
Stage 2: selection_positive
selection_positive:
- debugContext.debugData.behaviors|contains: 'POSITIVE'
- debugContext.debugData.logOnlySecurityData|contains: 'POSITIVE'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
debugContext.debugData.behaviors | match |
| field:"debugContext.debugData.behaviors" kind:match value:"POSITIVE" |
debugContext.debugData.logOnlySecurityData | match |
| field:"debugContext.debugData.logOnlySecurityData" kind:match value:"POSITIVE" |
eventType | eq |
| field:"eventType" kind:eq value:"policy.evaluate_sign_on" |
target.displayName | eq |
| field:"target.displayName" kind:eq value:"Okta Admin Console" |