Update User Session Impersonation(Okta).yaml

Solutions/Okta Single Sign-On/Analytic Rules/User Session Impersonation(Okta).yaml

@@ -16,9 +16,10 @@ queryPeriod: 6h
 triggerOperator: gt
 triggerThreshold: 0
 tactics:
-  - Defense Evasion
+  - PrivilegeEscalation
 relevantTechniques:
-  - T1656
+  - T1134
+  - T1134.003
 query: |
   Okta_CL
   | where eventType_s == "user.session.impersonation.initiate" and outcome_result_s == "SUCCESS"