Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
Detects the creation of a new domain user account that is immediately added to a high-privilege group, such as Domain Admins. This pattern is a strong indicator of persistence and privilege escalation, as observed in the Lynx Ransomware campaign.
Detects a user account creation event followed by that same account being added to a privileged administrative group within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the group addition event.
Detects a user account creation event in Azure AD followed by that same account being added to a privileged administrative role within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the role addition event.
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Cisco Local Accounts
Sigma
Find local accounts being created or modified as well as remote authentication configurations
Detects the creation of a new administrator account on a Fortinet FortiGate Firewall. This activity could indicate an attacker establishing persistence or escalating privileges within the network infrastructure.
Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.
Detects the creation of new user accounts within Okta. This rule specifically looks for the 'user.lifecycle.create' event type in Okta logs, indicating that a new user account has been provisioned in the identity management system.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
This rule detects the creation or modification of local user accounts and changes to remote authentication configurations on Cisco devices. It specifically looks for keywords 'username' and 'aaa' in Cisco AAA logs, indicating actions related to account management or authentication settings.
Detects the creation or modification of a computer account or user account with a suspicious name pattern 'SAMTHEADMIN-X$' (where X is a number) which is known to be generated by a hacktool exploiting CVE-2021-42287 and CVE-2021-42278. This pattern is associated with the 'Sam the Admin' vulnerability exploitation.
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
Detects when a new member is added or invited to a github organization.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Page 14 of 18