OneLogin User Assumed Another User Account

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•0•25

Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.