Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
365 detections
Filters
Last updated
All Time
Detection languages
171
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
187
56
46
38
37
Products / Services
122
40
32
27
26
MITRE Techniques
335
181
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
New User Creation Monitoring For On-Prem
Cortex XDR
This rule detects the creation of a new user account in Active Directory by monitoring for Windows Security Event ID 4720. It extracts the target username, target domain, and the user who performed the account creation to provide context for investigation.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
This rule detects the creation of a local user account named _BootUEFI_ and its addition to the Remote Desktop Users group, followed by RemoteInteractive logons using that account. This behavior is indicative of an RDP backdoor mechanism associated with the HeptaX campaign.
This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
Detects the creation of an administrative account named 'adminin' on FortiGate devices. This specific account name has been linked to the 'FortiBleed' credential theft campaign, which often serves as a precursor to ransomware deployment by threat actors like the INC Ransom group.
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
Detects the creation of local user accounts using the Windows net.exe utility, specifically looking for accounts containing the 'rage_master_' naming convention, often used by adversaries or automated tools for maintaining persistent access.
Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.
This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.
Detects the creation of a new local user account on a Windows system using the net.exe or net1.exe command-line utilities. This is a common technique used by attackers for establishing persistent access to a compromised system.
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
Page 6 of 18