OneLogin: Multiple User Accounts Assumed by a Single Principal

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•28

This rule detects when a single user account (principal) assumes the identity of multiple other user accounts (targets) within the OneLogin SSO system. Specifically, it triggers if a user, identified by their `userid`, performs "USER_RESOURCE_ACCESS" events as more than 3 distinct target users within a one-hour window. This behavior can indicate an attacker attempting to gain access to multiple accounts after compromising a single set of credentials, or an insider abusing their privileges.