detection.wiki

Detection rules › Sigma

New Okta User Created

Status
test
Severity
informational
Log source
product okta, service okta
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects new user account creation

Known false positives

  • Legitimate and authorized user creation

MITRE ATT&CK coverage

TacticTechniques
Credential AccessNo specific technique

Telemetry coverage

PlatformRecord / event type
OktaSystem Log event type user.lifecycle.create: Okta user created

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: New Okta User Created
id: b6c718dd-8f53-4b9f-98d8-93fdca966969
status: test
description: Detects new user account creation
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-25
modified: 2026-04-27
references:
    - https://developer.okta.com/docs/reference/api/event-types/
tags:
    - attack.credential-access
logsource:
    service: okta
    product: okta
detection:
    selection:
        eventType: 'user.lifecycle.create'
    condition: selection
falsepositives:
    - Legitimate and authorized user creation
level: informational

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    eventType: 'user.lifecycle.create'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
eventTypeeq
  • user.lifecycle.create
field:"eventType" kind:eq value:"user.lifecycle.create"