Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,402
11,796
5,865
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects when a user account is added to a high-privilege domain group (e.g., Domain Admins, Enterprise Admins, etc.)
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
This analytic detects the creation of privileged user accounts or the elevation of existing accounts to privilege level 15 (the highest administrative privilege level) on Cisco IOS devices. This activity is suspicious as it could indicate an attacker establishing backdoor access or persistence after gaining initial access, potentially through vulnerabilities like CVE-2018-0171. The rule specifically looks for commands related to setting user privilege to 15, modifying user passwords in conjunction with user table modifications, or explicit privilege updates to level 15.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
This rule monitors changes to users' Authenticator app registrations within Azure Active Directory. It detects unauthorized device additions or removals, which can be used by adversaries to bypass multi-factor authentication or maintain persistent access to compromised accounts. The rule parses audit logs for 'Update user' operations specifically targeting 'StrongAuthenticationPhoneAppDetail' to identify both added and removed Authenticator app devices.
This rule detects changes to user multi-factor authentication (MFA) configurations within Azure Active Directory. It identifies when MFA methods are added, removed, or changed for a user, providing details on the actor, target, and the specific changes made. This helps in auditing MFA configuration changes, detecting unauthorized modifications, supporting incident response, and ensuring compliance with security policies.
This rule identifies accounts that have been assigned administrative roles within the environment. It helps assess exposure risk by focusing on identities with elevated permissions, supports attack surface reduction by auditing role assignments, and enables proactive threat hunting for potential misuse of admin privileges.
This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
This detection rule identifies when Microsoft Copilot Studio agent properties are modified in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query
KQL Query from file: Detecting FIDO2 Passkey Abuse
KQL Query from file: BadSuccessor Detection
KQL Query
KQL Query from file: Entra Admin Roles Query
KQL Query from file: Entra ID Administrative Role (AD-Sync)
Page 23 of 29