sigmalowHunting

OneLogin User Assumed Another User

Detects when an user assumed another user account.

Detection Query

selection:
  event_type_id: 3
condition: selection

Author

Austin Songer @austinsonger

Created

2021-10-12

Data Sources

oneloginonelogin.events

Platforms

onelogin

References

https://developers.onelogin.com/api-docs/1/events/event-resource

Tags

attack.impact

Raw Content

title: OneLogin User Assumed Another User
id: 62fff148-278d-497e-8ecd-ad6083231a35
status: test
description: Detects when an user assumed another user account.
references:
    - https://developers.onelogin.com/api-docs/1/events/event-resource
author: Austin Songer @austinsonger
date: 2021-10-12
modified: 2022-12-25
tags:
    - attack.impact
logsource:
    product: onelogin
    service: onelogin.events
detection:
    selection:
        event_type_id: 3
    condition: selection
falsepositives:
    - Unknown
level: low