Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,417
11,806
5,870
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
Detects modifications to Windows user accounts where the 'Password Never Expires' flag is enabled. This modification, often represented by the DONT_EXPIRE_PASSWORD userAccountControl flag (Event ID 4738), may indicate an attempt to establish persistence or weaken credential lifecycle security by bypassing password rotation requirements.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
Windows Multiple User Accounts Disabled
Cortex XDR
Detects five or more distinct Windows user-account disable events (Event ID 4725) performed by the same actor on the same host within a one-hour time bucket, which may indicate unauthorized account access removal.
Reviews Microsoft Entra Privileged Identity Management (PIM) role activations and correlates them with activation justifications supplied by users.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
Detects modifications to the 'userPrincipalName' attribute in Active Directory via Security Event ID 5136 where the assigned value lacks an '@' character. This behavior is indicative of the ResetNightmare exploitation technique (CVE-2026-27912), which involves setting the UPN to a bare sAMAccountName to facilitate unauthorized password resets or account takeover.
Windows High-Value Account Disabled
Cortex XDR
Detects Windows Security Event ID 4725 which signals that a user account has been disabled. This rule specifically correlates the event with a locally maintained inventory of high-value accounts, such as executive, privileged, or service accounts, to identify potentially disruptive or unauthorized account access removal.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects a user registering a new MFA or authentication method within a short window after multiple failed Entra ID sign-in attempts, without a corresponding verified helpdesk password-reset ticket. This pattern is indicative of vishing or helpdesk-impersonation attacks aimed at hijacking user accounts by circumventing MFA controls.
User All Event Log Activity
Cortex XDR
This rule monitors Windows event logs for activity involving the SAM account name, which may indicate account enumeration, credential access attempts, or malicious modifications to account security settings.
Detects Okta MFA factor re-enrollment immediately preceded by a burst (>=2) of failed MFA authentication challenges within 15 minutes, indicating attacker-driven MFA takeover following AiTM credential theft.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
Disabled User Monitoring For On-Prem
Cortex XDR
This rule detects Windows Security Event ID 4725, which indicates that a user account has been disabled. It extracts relevant details such as the target user account, domain, and the user who performed the action to provide context for potential account-based denial-of-service or unauthorized access removal attempts.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
This rule detects potentially malicious activity against accounts classified as having a high blast radius. It correlates three stages of behavior: observed failed authentication attempts (brute force) against a high-blast-radius account, a password reset for that same account, and a subsequent successful logon outside of standard business hours (using Logon Types 3 or 10). The rule uses a password reset event as the mandatory anchor and flags suspicious sequences of events leading up to or following this change.
AD Group Changes and Membership Activity
Cortex XDR
This rule monitors Active Directory security event logs for modifications to local, global, and universal groups. It specifically tracks events related to the creation, deletion, and membership changes of AD groups, providing visibility into potential privilege escalation or unauthorized administrative activity within the domain.
This rule detects modifications to Google Workspace user account recovery methods, including the generation or deletion of 2SV (2-Step Verification) backup scratch codes, and changes to recovery email addresses or recovery phone numbers. These actions are often performed during account takeover attempts to establish persistence or facilitate bypassing MFA.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Page 14 of 29