Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1136-create-account

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful creation of admin user accounts or roles in Zscaler Internet Access (ZIA). Alerts when any administrator successfully creates a new account or role in the ZIA console.

Strategy

This rule monitors ZIA audit logs for OCSF Account Change events (@ocsf.class_uid is 3001) where the activity is a create operation (@ocsf.activity_id is 1) and the result is successful (@ocsf.status_id is 1). Admin account and role creation are high-privilege operations within ZIA that grant access to network security controls and policy management. Because any successful creation warrants analyst review, the rule alerts on the first matching event per administrator within the 24-hour evaluation window (additional events by the same administrator within that window are grouped into the same signal). The creating administrator is captured in @ocsf.actor.user.name and the created entity in @ocsf.user.name.

Triage and Response

• Verify whether {{@ocsf.actor.user.name}} is authorized to create new admin accounts or roles in ZIA and whether this action was expected.
• Review the identity and role of the newly created account or role ({{@ocsf.user.name}}) to determine the level of privilege granted.
• Check recent activity from {{@ocsf.actor.user.name}} in ZIA audit logs to identify any other privileged actions taken around the same time.
• Determine if a change management ticket or onboarding request exists that corresponds to this account creation.
• Examine whether the created account has been used since creation and from which IP addresses or locations.