OneLogin Application Password Revealed

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•31

This rule detects when a user in OneLogin reveals another user's application password. This is identified by monitoring 'USER_RESOURCE_ACCESS' events from 'ONELOGIN_SSO' where the product event type is '240' (indicating an actor user revealed a password to an app for another user) and the principal user ID is different from the target user ID. This scenario suggests unauthorized access or disclosure of credentials.