Okta New API Token Created

Status: production
Severity: medium
Group by: All_Changes.action, All_Changes.command, All_Changes.dest, All_Changes.object_category, All_Changes.result, All_Changes.src, All_Changes.user, _time, sourcetype
Author: Michael Haag, Mauricio Velazco, Splunk
Source: github.com/splunk/security_content

The following analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the system.api_token.create command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.

Known false positives

False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.001` Valid Accounts: Default Accounts
Persistence	`T1078.001` Valid Accounts: Default Accounts
Privilege Escalation	`T1078.001` Valid Accounts: Default Accounts
Stealth	`T1078.001` Valid Accounts: Default Accounts

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `system.api_token.create`: API token created

Rules detecting the same action

These rules filter on the same operation.

Attempt to Create Okta API Token (Elastic)
High-Risk Admin Activity (Kusto)
New Device/Location sign-in along with critical operation (Kusto)
Okta AD Agent Token Abuse - Behavioral (Panther)
Okta API Key Created (Panther)
Okta API Token Created (Sigma)
Okta New API Token Created (YARA-L)
Query.Okta.ADAgentTokenAbuseBehavioral (Panther)

Rule body

name: Okta New API Token Created
id: c3d22720-35d3-4da4-bd0a-740d37192bd4
version: 14
creation_date: '2022-12-19'
modification_date: '2026-05-13'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
data_source:
    - Okta
search: |-
    | tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
      WHERE All_Changes.action=created
        AND
        All_Changes.command=system.api_token.create
      BY _time span=5m All_Changes.user
         All_Changes.result All_Changes.command sourcetype
         All_Changes.src All_Changes.action All_Changes.object_category
         All_Changes.dest
    | `drop_dm_object_name("All_Changes")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `okta_new_api_token_created_filter`
how_to_implement: The analytic leverages Okta OktaIm2 logs to be ingested using the Splunk Add-on for Okta Identity Cloud (https://splunkbase.splunk.com/app/6553).
known_false_positives: False positives may be present. Tune Okta and tune the analytic to ensure proper fidelity. Modify risk score as needed.
references:
    - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected
    - https://splunkbase.splunk.com/app/6553
finding:
    title: A new API token was created in Okta by [$user$]. Investigate further to determine if this was authorized.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Okta Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: Okta Tenant
mitre_attack_id:
    - T1078.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: access

Stages and Predicates

Stage 1: `tstats`

| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime FROM datamodel=Change
  WHERE All_Changes.action=created
    AND
    All_Changes.command=system.api_token.create
  BY _time span=5m All_Changes.user
     All_Changes.result All_Changes.command sourcetype
     All_Changes.src All_Changes.action All_Changes.object_category
     All_Changes.dest

Stage 2: `search`

| `drop_dm_object_name("All_Changes")`

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `okta_new_api_token_created_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`All_Changes.action`	eq	`created`	`field:"All_Changes.action" kind:eq value:"created"`
`All_Changes.command`	eq	`"system.api_token.create"`	`field:"All_Changes.command" kind:eq`