huntrule

Possible Creation of New Okta User (via okta)

This rule detects new user account creation

SigmainformationalIdentityv1
sigma
title: Possible Creation of New Okta User (via okta)
id: 70dd4639-1c40-5cfd-bd84-cfaa4ef5151d
status: stable
description: This rule detects new user account creation
author: Huntrule Team
date: 2026-06-14
references:
    - https://developer.okta.com/docs/reference/api/event-types/
tags:
    - attack.credential-access
    - attack.persistence
    - attack.t1136.003
logsource:
    service: okta
    product: okta
detection:
    selection:
        eventType: 'user.lifecycle.create'
    condition: selection
falsepositives:
    - Unknown
level: informational

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.