Okta 2023 Breach Indicator Of Compromise

calendar Apr 27, 2026 · attack.credential-access detection.emerging-threats  ·
Share on: linkedin copy

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Sigma rule (View on GitHub)

 1title: Okta 2023 Breach Indicator Of Compromise
 2id: 00a8e92a-776b-425f-80f2-82d8f8fab2e5
 3status: test
 4description: |
 5    Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach.
 6    This rule can be enhanced by filtering out known and legitimate username used in your environnement.    
 7author: Muhammad Faisal (@faisalusuf)
 8date: 2023-10-25
 9modified: 2026-04-27
10references:
11    - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
12    - https://developer.okta.com/docs/reference/api/event-types/
13tags:
14    - attack.credential-access
15    - detection.emerging-threats
16logsource:
17    service: okta
18    product: okta
19detection:
20    selection:
21        eventType:
22            - 'user.lifecycle.create'
23            - 'user.lifecycle.activate'
24        target.displayName|contains: 'svc_network_backup'
25    condition: selection
26falsepositives:
27    - Unknown
28level: medium

References

Related rules

to-top