Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).
Detects a suspicious pattern in SAP environments where an existing user creates a new account (AU7 - User created) and subsequently logs into that newly created account (AU1 - User logged on or AU5 - User logged on via RFC) from the same terminal/IP address within a 30-minute window, potentially indicating account takeover or unauthorized persistence.
This rule detects the use of the `useradd` command on Linux systems with options that grant elevated privileges or modify user home directory creation. Specifically, it looks for the creation of users with UID or GID 0 (root privileges), or options that prevent home directory creation (`--no-create-home` or `-M`), which can be indicative of malicious user account creation for persistence or privilege escalation.
Detects when an external user is invited to the Entra ID tenant. This could indicate legitimate collaboration or an attempt by an attacker to gain initial access or establish persistence by inviting a malicious external account.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects the creation of a new computer account (Event ID 4741) where the creating user is a known service account used by FortiGate appliances. Attackers who compromise FortiGate devices can steal embedded LDAP credentials and use them to join rogue workstations to the domain, leveraging the `mS-DS-MachineAccountQuota` attribute.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
Detects the creation of new user accounts on Linux systems using the 'useradd' command with parameters that grant root (UID 0 or GID 0) privileges, or prevent home directory creation, which can indicate a backdoor account.
Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.
This rule detects the creation of new local user accounts or the addition of existing accounts to the local Administrators group on Windows systems. It specifically looks for Windows Security Event IDs 4720 (A user account was created) and 4732 (A member was added to a security-enabled local group) or 4728 (A member was added to a security-enabled global group) or 4756 (A member was added to a security-enabled universal group), filtering for 'User' account types and ensuring that for Event ID 4732, the group is the 'Administrators' group (identified by SID S-1-5-32-544 or group name). This activity can indicate an adversary establishing persistence or escalating privileges.
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.
Detects when a new AWS IAM Principal (User, Role, or Group) is created and then has a policy attached to it by the same actor within a 10-minute time frame. This sequence is a suspicious TTP often used by attackers to provision a new, privileged "shadow" account or role for persistence and lateral movement, bypassing existing accounts or role assumption paths.
Detects the creation of a new Personal Access Token (PAT) in GitHub. Attackers frequently create PATs after gaining initial access to an account to maintain persistence that survives a password reset. Tokens with broad scopes (repo, admin:org) allow for full repository exfiltration and administrative manipulation of the organization.
This rule detects when an external user is invited to Azure Active Directory (AAD) from a common, publicly available email domain (e.g., gmail.com, outlook.com, yahoo.com). This can be an indicator of an attacker attempting to establish persistence or gain initial access by inviting an external account they control, or it could be a legitimate business process for collaboration with external parties using personal email addresses.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
Detects the creation of hidden local user accounts (`admin$`, `mysql$`, `mssql$`, `admin1$`, `admin2$`, `power$`) using `net.exe` or `net1.exe` as used by the threat actor UAT-8099 for persistence on compromised IIS servers. The rule also broadly detects any account creation ending with a '$' symbol, which often indicates a hidden account.
Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.
This rule detects the creation of a local administrative account on a FortiGate device with a generic name commonly used by threat actors for persistence following an initial compromise. The rule specifically looks for log events indicating the addition of a new system administrator account with names like 'secadmin', 'itadmin', 'support', 'backup', 'remoteadmin', or 'audit'.
Detects the creation of a new administrative account with 'prof_admin' privileges on a FortiWeb device from an unknown IP address. This activity is highly suspicious if not performed by a known administrator and could indicate post-exploitation activity, potentially related to CVE-2025-64446.
Page 13 of 18