Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.
This rule detects the use of `System.DirectoryServices.AccountManagement` within PowerShell script block logs. This .NET namespace is commonly used to programmatically manage Active Directory security principals such as users, computers, and groups. Adversaries may use this method to create new domain accounts, modify existing ones, or manipulate group memberships to establish persistence or elevate privileges within an Active Directory environment.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
Local User Creation
Sigma
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Page 18 of 18