Detectioninformationaltest

New Okta User Created

Detects new user account creation

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed Oct 25b6c718dd-8f53-4b9f-98d8-93fdca966969identity

Log Source

Oktaokta

ProductOkta← raw: okta

Serviceokta← raw: okta

Detection Logic

detection:
    selection:
        eventtype: 'user.lifecycle.create'
    condition: selection

False Positives

Legitimate and authorized user creation

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

b6c718dd-8f53-4b9f-98d8-93fdca966969

Status

test

Level

informational

Type

Detection

Created

Wed Oct 25

Author

Path

rules/identity/okta/okta_user_created.yml

Raw Tags

attack.credential-access