AR Microsoft Sentinel Analytic Rules ONLINE

Analytic rule catalog

User Session ImpersonationOkta

Back
Id35846296-4052-4de2-8098-beb6bb5f2203
RulenameUser Session Impersonation(Okta)
DescriptionThis query detects instances of user session impersonation, where an attacker successfully initiates a session impersonation event. The query extracts detailed information about the target user and the actor involved in the impersonation, providing insights into potential privilege escalation activities.
SeverityMedium
TacticsPrivilegeEscalation
TechniquesT1134
T1134.003
Required data connectorsOktaSSO
OktaSSOv2
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta%20Single%20Sign-On/Analytic%20Rules/UserSessionImpersonation.yaml
Version1.1.1
Arm template35846296-4052-4de2-8098-beb6bb5f2203.json
Deploy To Azure
OktaSSO
| where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
// Expand the JSON array in 'target_s' field to extract detailed information about the event
| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array
// Enhance visibility by extending columns with extracted details for better analysis
| extend TargetUser_id = tostring(parsed_json.id), 
         TargetUser_type = tostring(parsed_json.type), 
         TargetUser_alternateId = tostring(parsed_json.alternateId), 
         TargetUser_displayName = tostring(parsed_json.displayName), 
         Target_detailEntry = tostring(parsed_json.detailEntry)
// Filter out events with unknown target user IDs to focus on valid impersonation attempts
| where isnotempty(TargetUser_alternateId) and TargetUser_alternateId != "unknown"
// Project event details to gain insights into the security context, including actor and target user information
| project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, TargetUser_displayName, TargetUser_type, TargetUser_id, eventType_s, outcome_result_s
| extend AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
name: User Session Impersonation(Okta)
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta%20Single%20Sign-On/Analytic%20Rules/UserSessionImpersonation.yaml
triggerOperator: gt
status: Available
queryPeriod: 6h
requiredDataConnectors:
- connectorId: OktaSSO
  dataTypes:
  - Okta_CL
- connectorId: OktaSSOv2
  dataTypes:
  - OktaSSO
tactics:
- PrivilegeEscalation
query: |
  OktaSSO
  | where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"
  // Expand the JSON array in 'target_s' field to extract detailed information about the event
  | mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array
  // Enhance visibility by extending columns with extracted details for better analysis
  | extend TargetUser_id = tostring(parsed_json.id), 
           TargetUser_type = tostring(parsed_json.type), 
           TargetUser_alternateId = tostring(parsed_json.alternateId), 
           TargetUser_displayName = tostring(parsed_json.displayName), 
           Target_detailEntry = tostring(parsed_json.detailEntry)
  // Filter out events with unknown target user IDs to focus on valid impersonation attempts
  | where isnotempty(TargetUser_alternateId) and TargetUser_alternateId != "unknown"
  // Project event details to gain insights into the security context, including actor and target user information
  | project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, TargetUser_displayName, TargetUser_type, TargetUser_id, eventType_s, outcome_result_s
  | extend AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])
description: |
  This query detects instances of user session impersonation, where an attacker successfully initiates a session impersonation event. The query extracts detailed information about the target user and the actor involved in the impersonation, providing insights into potential privilege escalation activities.
severity: Medium
id: 35846296-4052-4de2-8098-beb6bb5f2203
customDetails:
  EventType: eventType_s
  TargetUserAltId: TargetUser_alternateId
  ActorDisplayName: actor_displayName_s
  TargetUserName: TargetUser_displayName
  TargetUserType: TargetUser_type
triggerThreshold: 0
queryFrequency: 6h
alertDetailsOverride:
  alertDescriptionFormat: Okta user session impersonation succeeded. Actor {{actor_alternateId_s}} impersonated target {{TargetUser_alternateId}} during {{eventType_s}}.
  alertDisplayNameFormat: Okta session impersonation by {{actor_displayName_s}} for {{TargetUser_displayName}}
version: 1.1.1
relevantTechniques:
- T1134
- T1134.003

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/35846296-4052-4de2-8098-beb6bb5f2203')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/35846296-4052-4de2-8098-beb6bb5f2203')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Okta user session impersonation succeeded. Actor {{actor_alternateId_s}} impersonated target {{TargetUser_alternateId}} during {{eventType_s}}.",
          "alertDisplayNameFormat": "Okta session impersonation by {{actor_displayName_s}} for {{TargetUser_displayName}}"
        },
        "alertRuleTemplateName": "35846296-4052-4de2-8098-beb6bb5f2203",
        "customDetails": {
          "ActorDisplayName": "actor_displayName_s",
          "EventType": "eventType_s",
          "TargetUserAltId": "TargetUser_alternateId",
          "TargetUserName": "TargetUser_displayName",
          "TargetUserType": "TargetUser_type"
        },
        "description": "This query detects instances of user session impersonation, where an attacker successfully initiates a session impersonation event. The query extracts detailed information about the target user and the actor involved in the impersonation, providing insights into potential privilege escalation activities.\n",
        "displayName": "User Session Impersonation(Okta)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta%20Single%20Sign-On/Analytic%20Rules/UserSessionImpersonation.yaml",
        "query": "OktaSSO\n| where eventType_s == \"user.session.impersonation.initiate\" and outcome_result_s == \"SUCCESS\"\n// Expand the JSON array in 'target_s' field to extract detailed information about the event\n| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array\n// Enhance visibility by extending columns with extracted details for better analysis\n| extend TargetUser_id = tostring(parsed_json.id), \n         TargetUser_type = tostring(parsed_json.type), \n         TargetUser_alternateId = tostring(parsed_json.alternateId), \n         TargetUser_displayName = tostring(parsed_json.displayName), \n         Target_detailEntry = tostring(parsed_json.detailEntry)\n// Filter out events with unknown target user IDs to focus on valid impersonation attempts\n| where isnotempty(TargetUser_alternateId) and TargetUser_alternateId != \"unknown\"\n// Project event details to gain insights into the security context, including actor and target user information\n| project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, TargetUser_displayName, TargetUser_type, TargetUser_id, eventType_s, outcome_result_s\n| extend AccountName = tostring(split(actor_alternateId_s, \"@\")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, \"@\")[1])\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1134.003"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1134"
        ],
        "templateVersion": "1.1.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}