New Okta User Created

calendar Apr 27, 2026 · attack.credential-access  ·
Share on: linkedin copy

Detects new user account creation

Sigma rule (View on GitHub)

 1title: New Okta User Created
 2id: b6c718dd-8f53-4b9f-98d8-93fdca966969
 3status: test
 4description: Detects new user account creation
 5author: Nasreddine Bencherchali (Nextron Systems)
 6date: 2023-10-25
 7modified: 2026-04-27
 8references:
 9    - https://developer.okta.com/docs/reference/api/event-types/
10tags:
11    - attack.credential-access
12logsource:
13    service: okta
14    product: okta
15detection:
16    selection:
17        eventType: 'user.lifecycle.create'
18    condition: selection
19falsepositives:
20    - Legitimate and authorized user creation
21level: informational

References

Related rules

to-top