Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,417
11,806
5,870
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
This rule detects when a previously disabled Active Directory user account is re-enabled. Monitoring for account enablement is critical as it can be a sign of an adversary reactivating a dormant or service account to maintain persistence or conduct lateral movement.
Detects instances where an interactive user initiates a password change attempt as captured by Windows Security Event ID 4723. The rule filters out non-interactive accounts (ending with '$') and common service account naming patterns to focus on human-driven account modifications.
This rule detects when a previously disabled Active Directory user account is re-enabled. Monitoring for account enablement is critical as it can be a sign of an adversary reactivating a dormant or service account to maintain persistence or conduct lateral movement.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.
This rule detects indicators of the DCShadow attack technique by monitoring for the creation of nTDSDSA objects (which define domain controllers) or the addition of suspicious Service Principal Names (SPNs) often used in DCShadow simulations (GC/ or E3514235-4B06) to computer accounts. These indicators suggest an attacker is attempting to register a rogue Domain Controller to manipulate Active Directory data.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
Detects successful authentication for a user account immediately following a password change event. This pattern is indicative of a compromised PAM (Pluggable Authentication Modules) component or similar authentication backdoor that utilizes a hardcoded 'master' password to maintain access, bypassing credential rotation. This behavior is associated with the threat actor Velvet Ant (Operation Highland).
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects changes to a user account's User Account Control (UAC) settings, specifically when the 'NewUacValue' is set to '0x2080'. This value corresponds to the 'ACCOUNTDISABLE' flag, indicating that a user account has been disabled. Monitoring such changes can help identify potential malicious activity where an attacker might disable legitimate user accounts to disrupt operations or hinder incident response.
Detects the use of Windows Package Manager utilities (winget.exe, WindowsPackageManagerServer.exe) or ConfigurationRemotingServer.exe to execute administrative commands related to local user and group management, such as adding users or modifying group memberships. This behavior is highly irregular for these binaries and suggests potential abuse for persistence or privilege escalation.
Detects modifications to computer or user accounts in Active Directory where the 'Trusted for Delegation' flag is enabled. Enabling unconstrained delegation allows a compromised account to request and cache Ticket Granting Tickets (TGTs) for any user authenticating to the service, enabling potential privilege escalation and lateral movement.
Page 16 of 29