Okta: User created/activated for svc_network_backup account

title: "Okta: User created/activated for svc_network_backup account"
id: b8078fb4-3452-478e-89b3-5f3c27d6635c
status: test
description: This rule flags Okta user lifecycle events where a new account is created or an account is activated and the target display name contains "svc_network_backup". Such targeted account provisioning can indicate attacker-driven setup of a service account or persistence mechanism following unauthorized access. The detection relies on Okta event telemetry for user.lifecycle.create and user.lifecycle.activate, including the target displayName field.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-10-25
modified: 2026-04-27
references:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml
tags:
  - attack.credential-access
  - detection.emerging-threats
logsource:
  service: okta
  product: okta
detection:
  selection:
    eventType:
      - user.lifecycle.create
      - user.lifecycle.activate
    target.displayName|contains: svc_network_backup
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 00a8e92a-776b-425f-80f2-82d8f8fab2e5
    type: derived