Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
This rule identifies when an owner is removed from an application or service principal within Azure Active Directory. This activity could indicate an attempt to remove legitimate administrative access or to obscure malicious activity by removing an owner who might detect it.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.
This rule detects the use of `System.DirectoryServices.AccountManagement` within PowerShell script block logs. This .NET namespace is commonly used to programmatically manage Active Directory security principals such as users, computers, and groups. Adversaries may use this method to create new domain accounts, modify existing ones, or manipulate group memberships to establish persistence or elevate privileges within an Active Directory environment.
Identifies when a service account is disabled or deleted in Google Cloud.
Identifies when a service account is modified in Google Cloud.
Page 29 of 29