Update User Session Impersonation(Okta).yaml

changed the mitre tech and id
Azure · Dec 29, 2023 · cb9f890 · cb9f890
1 parent f20bf26
commit cb9f890
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta).yaml b/Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta).yaml
@@ -16,10 +16,9 @@ queryPeriod: 6h
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
-  - PrivilegeEscalation
+  - DefenseEvasion
 relevantTechniques:
-  - T1134
-  - T1134.003
+  - T1656
 query: |
   Okta_CL
   | where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"