Okta New User Created via user.lifecycle.create Event
Flags Okta events indicating new user account creation via user.lifecycle.create.
FreeReviewedSigma · Informational · v4
- Product
- okta
- Service
- okta
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
What it detects
This rule flags Okta events where a new user account is created, identified by the user.lifecycle.create event type. Attackers may create accounts to establish persistence, gain access, or set up further activity within the identity tenant. Detection relies on Okta service event telemetry that records user lifecycle create operations.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
okta-user-lifecycle-create-event-for-new-user-accounts-b6c718dd
title: Okta New User Created via user.lifecycle.create Event
id: 69480783-3cd8-4d7a-8cdd-15dfa37fa982
status: test
description: This rule flags Okta events where a new user account is created, identified by the user.lifecycle.create event type. Attackers may create accounts to establish persistence, gain access, or set up further activity within the identity tenant. Detection relies on Okta service event telemetry that records user lifecycle create operations.
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
modified: 2026-04-27
references:
- https://developer.okta.com/docs/reference/api/event-types/
- https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_user_created.yml
tags:
- attack.credential-access
logsource:
service: okta
product: okta
detection:
selection:
eventType: user.lifecycle.create
condition: selection
falsepositives:
- Legitimate and authorized user creation
level: informational
license: DRL-1.1
related:
- id: b6c718dd-8f53-4b9f-98d8-93fdca966969
type: derived