Okta: Detect new or activated user accounts named svc_network_backup
Alerts on Okta account creation or activation events for target display names containing svc_network_backup.
FreeReviewedSigma · Medium · v5
- Product
- okta
- Service
- okta
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
What it detects
This rule flags Okta events where a user account is newly created or activated and the target display name contains svc_network_backup. Such account lifecycle changes can indicate unauthorized provisioning or activation following compromise, making this a useful credential-access signal. It relies on Okta service telemetry for user.lifecycle.create and user.lifecycle.activate events and the target displayName field.
Reporting behind it
- beyondtrust.comhttps://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- developer.okta.comhttps://developer.okta.com/docs/reference/api/event-types/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-user-created-activated-for-svc-network-backup-account-00a8e92a
title: "Okta: Detect new or activated user accounts named svc_network_backup"
id: b8078fb4-3452-478e-89b3-5f3c27d6635c
status: test
description: This rule flags Okta events where a user account is newly created or activated and the target display name contains svc_network_backup. Such account lifecycle changes can indicate unauthorized provisioning or activation following compromise, making this a useful credential-access signal. It relies on Okta service telemetry for user.lifecycle.create and user.lifecycle.activate events and the target displayName field.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-10-25
modified: 2026-04-27
references:
- https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml
tags:
- attack.credential-access
- detection.emerging-threats
logsource:
service: okta
product: okta
detection:
selection:
eventType:
- user.lifecycle.create
- user.lifecycle.activate
target.displayName|contains: svc_network_backup
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 00a8e92a-776b-425f-80f2-82d8f8fab2e5
type: derived