Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,417
11,806
5,870
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
This rule detects the deletion or disabling of Google Cloud IAM service accounts in GCP Audit Logs. These actions are often associated with cleanup activities by an adversary trying to remove persistence or hinder forensic investigations and incident response.
Detects the creation or update of IAM custom roles in Google Cloud Platform. This activity can be indicative of privilege escalation or the establishment of persistence by an adversary modifying access controls.
Detects the use of the 'net.exe' command to reset the password of a local administrator account. This behavior is specifically associated with the NoEscape ransomware, which utilizes this command as part of its impact-oriented activity to prevent authorized access to the compromised system.
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.
Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.
Detects the use of WMIC to rename a local administrator account to 'NO ESCAPE'. This behavior is associated with the NoEscape ransomware, which renames the built-in administrator account to 'NO ESCAPE' as part of its post-compromise activity.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Detects high-frequency MFA factor updates, resets, activations, deactivations, or deletions for a single user within a 30-minute window. This behavior often indicates an adversary attempting to compromise or take control of account authentication mechanisms after gaining initial access.
Detects the execution of 'net.exe' from a 'powershell.exe' parent process to either reset the local administrator password or reactivate a built-in domain administrator account. This behavior is associated with the Akira ransomware group's pre-encryption stage to ensure access to compromised endpoints.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.
The group could be used to grant VPN access to a network.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
Detects signs of persistence via account manipulation consistent with the Obsidian Sandstorm actor. The rule monitors for unauthorized password resets on administrative accounts (Event IDs 4723, 4724), the addition of users to highly privileged security groups (Event IDs 4728, 4732), and modifications to user account attributes (Event ID 4738) that indicate changes in account control flags.
Page 15 of 29