Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
This analytic detects attempts to create an "ESX Admins" group using PowerShell commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory.
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
The following analytic detects the creation of a Service Principal in an Azure AD environment. It leverages Azure Active Directory events ingested through EventHub, specifically monitoring the "Add service principal" operation. This activity is significant because Service Principals can be used by adversaries to establish persistence and bypass multi-factor authentication and conditional access policies. If confirmed malicious, this could allow attackers to maintain single-factor access to the Azure AD environment, potentially leading to unauthorized access to resources and prolonged undetected activity.
The following analytic detects the invitation of an external guest user within Azure AD. It leverages Azure AD AuditLogs to identify events where an external user is invited, using fields such as operationName and initiatedBy. Monitoring these invitations is crucial as they can lead to unauthorized access if abused. If confirmed malicious, this activity could allow attackers to gain access to internal resources, potentially leading to data breaches or further exploitation of the environment.
The following analytic detects the addition of new service principal accounts in O365 tenants. It leverages data from the `o365_management_activity` dataset, specifically monitoring for operations related to adding or creating service principals. This activity is significant because attackers can exploit service principals to gain unauthorized access and perform malicious actions within an organization's environment. If confirmed malicious, this could allow attackers to interact with APIs, access resources, and execute operations on behalf of the organization, potentially leading to data breaches or further compromise.
The analytic identifies a computer account creating a new computer account with a specific Service Principal Name (SPN) "RestrictedKrbHost". This behavior is significant as it may indicate an attempt to establish unauthorized Kerberos authentication channels, potentially leading to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to impersonate services, access sensitive information, or maintain persistence within the network.
The analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
Detect users who are newly created and then immediately assigned administrator level roles
Detects when a user is created in Entra ID and assigned roles within a defined time window.
Detects when a new group is successfully created within Office 365. This rule specifically looks for events indicating a 'GROUP_CREATION' event type with a product event type of 'Add group.' originating from 'Office 365' by 'Microsoft', where the action was 'ALLOW'. This can help identify legitimate administrative actions or potentially unauthorized group creation.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Detects the creation of a local user account named "DarkGate" with the username "SafeMode" using the `net.exe` or `net1.exe` command-line utility. This specific pattern is associated with DarkGate malware activity.
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
Detects the creation of a new user account on Linux systems. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. The rule specifically looks for 'SYSCALL' events where the executable ends with '/useradd' or 'ADD_USER' record types from auditd logs.
Detects the creation of local user accounts on Windows servers. In environments utilizing Active Directory, local user creation on member servers is generally an anomalous event and could indicate an adversary establishing persistence or creating backdoor accounts. This rule is specifically designed for Windows server logs and should not be applied to Domain Controller logs, as local user creation on DCs is not applicable.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
Detects the creation of suspicious local accounts that mimic the 'ANONYMOUS LOGON' account, potentially using additional spaces or other obfuscation techniques. This rule specifically targets Event ID 4720 (A security-enabled local group was created) and looks for 'ANONYMOUS' and 'LOGON' within the SamAccountName field, aiming to cover scenarios where such accounts are created to bypass detection or for malicious persistence.
Page 17 of 18