Okta 2023 Breach Indicator Of Compromise

Status: test
Severity: medium
Log source: product okta, service okta
Author: Muhammad Faisal (@faisalusuf)
Source: github.com/SigmaHQ/sigma

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	No specific technique

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.lifecycle.activate`: Okta user activated
Okta	System Log event type `user.lifecycle.create`: Okta user created

Rules detecting the same action

These rules filter on the same operation.

New Okta User Created (Sigma)

Rule body

title: Okta 2023 Breach Indicator Of Compromise
id: 00a8e92a-776b-425f-80f2-82d8f8fab2e5
status: test
description: |
    Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach.
    This rule can be enhanced by filtering out known and legitimate username used in your environnement.
author: Muhammad Faisal (@faisalusuf)
date: 2023-10-25
modified: 2026-04-27
references:
    - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
    - https://developer.okta.com/docs/reference/api/event-types/
tags:
    - attack.credential-access
    - detection.emerging-threats
logsource:
    service: okta
    product: okta
detection:
    selection:
        eventType:
            - 'user.lifecycle.create'
            - 'user.lifecycle.activate'
        target.displayName|contains: 'svc_network_backup'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventType:
        - 'user.lifecycle.create'
        - 'user.lifecycle.activate'
    target.displayName|contains: 'svc_network_backup'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventType`	eq	`user.lifecycle.activate` `user.lifecycle.create`	`field:"eventType" kind:eq`
`target.displayName`	match	`svc_network_backup`	`field:"target.displayName" kind:match value:"svc_network_backup"`