OneLogin Super User Privileges Assigned
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
YARA-L
