Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Detects post-exploitation behavior where a PaperCut server Java process spawns local account creation or administrator reset followed closely by Active Directory enumeration on the same host, indicating potential post-RCE meterpreter activity.
This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Detects the creation of WordPress administrator accounts using MySQL or WP-CLI command-line tools on hosts, specifically looking for specific username prefixes or email domains associated with suspicious activities.
Detects a new agent account in Zendesk. An agent can read customer conversations and
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
correspond with customers under the organisation's name — which makes an
unauthorised agent account both a data exposure and a channel for defrauding the
organisation's own customers.
Onboarding: ZENDESK is ingested via NXLog (Bloo extractor 831).
Integration guide: https://bloo.io/docs/hypercloud/zendesk-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ZENDESK' and action='USER_ADDED'
| groupby user, targetuser, role
Detects account creation on the wireless controller. Network infrastructure accounts
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
Detects creation of a new local administrative account on or through a
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects a user being invited into an Atlassian site. Invitation is the lowest-friction
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
route into a documentation estate: no exploit, no credential theft, simply an account
added by someone with the rights to do so.
Compare the invited domain against the organisation's own; an external domain
invitation outside a known partner arrangement warrants confirmation.
Onboarding: ATLASSIAN is ingested via NXLog (Bloo extractor 832).
Integration guide: https://bloo.io/docs/hypercloud/atlassian-connector
BQL (Bloo Query Language):
stream=iam where sourcename='ATLASSIAN'
and action in ('USER_INVITED', 'USER_REINVITED')
| groupby user, targetuser, domain, sitename
Detects account creation on the NAS. Storage appliances are often administered
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
outside central identity management, so a local account created on one is both
durable persistence and largely invisible to directory-based monitoring.
An account created here survives domain-level remediation entirely.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='DISKSTATION-NAS' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
Detects creation of a database user observed by Guardium. Database-level accounts
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
frequently sit outside enterprise identity governance, which makes them attractive
persistence: an account created directly in the database survives directory cleanup
and is rarely reviewed.
Onboarding: IBM-GUARDIUM is ingested via Syslog (KV) (Bloo extractor 282).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='IBM-GUARDIUM' and action='USER_CREATED'
| groupby user, targetuser, role, srcip
A single actor created or deleted SAP BTP subaccount users in bulk
This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory.
The following analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode 4732 (user added to Administrators group). This activity is significant as it indicates potential unauthorized privilege escalation, which is critical for SOC monitoring. If confirmed malicious, this could allow attackers to gain administrative access, leading to unauthorized data access, system modifications, and disruption of services. Immediate investigation is required to mitigate risks and prevent further unauthorized actions.
The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
The following analytic detects the rapid creation and deletion of Windows accounts within a short time frame of 1 hour. It leverages the "Change" data model in Splunk, specifically monitoring events with result IDs 4720 (account creation) and 4726 (account deletion). This behavior is significant as it may indicate an attacker attempting to create and remove accounts quickly to evade detection or gain unauthorized access. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further malicious actions within the environment. Immediate investigation of flagged events is crucial to mitigate potential damage.
The following analytic detects the creation of a new local user account on a Windows system. It leverages Windows Security Audit logs, specifically event ID 4720, to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
Detects the creation or modification of system users and groups on NetScaler ADC/Gateway appliances by monitoring Syslog events (e.g., nsconmsg, audit logs). The rule specifically triggers when these actions occur outside of standard business hours or on weekends, indicating potential unauthorized account manipulation or unauthorized persistence mechanisms.
Detects the creation or modification of a local NetScaler administrative account with superuser (nsroot-level) privileges via the appliance CLI or management API. This activity is indicative of persistent administrative backdoors potentially established after the exploitation of vulnerabilities such as CVE-2026-88771 or CVE-2026-88772.
This rule monitors for high-impact configuration API calls and the creation of new administrator accounts within the Cisco Secure Firewall Management Center (FMC). These actions are indicative of post-exploitation activity related to CVE-2026-20079, which allows for authentication bypass. The detection focuses on sensitive administrative actions such as policy deployment, certificate exports, and user account creation which, if performed without valid session context, suggest an unauthorized actor.
Page 1 of 18