Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects when a user account is added to a security-enabled global, local, or universal group in Active Directory. This behavior is captured by monitoring Security Events 4728 (global group), 4732 (local group), and 4756 (universal group). The rule flags actions performed by user accounts (excluding system accounts) and aggregates them by the source account performing the modification.
Detects when a user account is added to a security-enabled global, local, or universal group in Active Directory. This behavior is captured by monitoring Security Events 4728 (global group), 4732 (local group), and 4756 (universal group). The rule flags actions performed by user accounts (excluding system accounts) and aggregates them by the source account performing the modification.
Detects the creation of a local administrator account or modification of the Administrators group through ConfigurationRemotingServer.exe. This activity is associated with the DSCourier persistence technique, which leverages Windows PowerShell Desired State Configuration (DSC) to maintain unauthorized administrative access.
Detects the creation of a local user account followed immediately by the addition of that same account to the local Administrators group using the built-in Windows net.exe or net1.exe utilities. This pattern is commonly observed during adversary post-exploitation activity to establish persistence or escalate privileges.
Detects the creation of user accounts or modifications to sensitive groups (Event IDs 4720, 4728, 4732, 4756) where the account name matches naming conventions typically associated with backup service accounts or elevated administrative roles (e.g., prefix 'backup_', 'bkp_' or suffix '_da', '_ea'). This activity can indicate an attacker attempting to establish persistence or escalate privileges via compromised or newly created accounts.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects the creation of a new local account using the 'net' utility, followed immediately by that account being added to the local administrators group on the same endpoint. This behavior is a common indicator of persistence or privilege escalation attempts.
Detects unauthorized attempts by a non-super-administrator user within the MyBB Admin Control Panel to assign the administrator group (usergroup=4) to a new or existing user, exploiting a privilege boundary bypass.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
Detects when a user or machine account is added to a highly privileged Active Directory group. This event is often a sign of privilege escalation or persistence establishment by an adversary.
Detects when a user or machine account is added to a highly privileged Active Directory group. This event is often a sign of privilege escalation or persistence establishment by an adversary.
This rule detects the creation of a new domain user account followed by its immediate addition to a privileged Active Directory group within a short timeframe. It specifically ignores common provisioning accounts and service accounts. A high risk score is assigned if the privileged group assignment occurs within 5 minutes of account creation, flagging potentially malicious account takeovers or privilege escalation activity.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
Detects the creation of local backdoor accounts with the 'rage_master_' username prefix and their subsequent addition to the local Administrators group using 'net.exe' or 'net1.exe', which is a technique characteristic of the TrymeLocker malware.
Detects the threat actor executing net user /add and adding the account to the local Administrators group to maintain interactive access via RDP.
Detects the use of net.exe or net1.exe to add a local user account to the 'Administrators' or 'Remote Desktop Users' groups. This is a common technique used by attackers to gain persistent, elevated access or enable remote access to a compromised machine.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.
Correlates the creation of a local user with the immediate addition of that user to the "Remote Desktop Users" or "Administrators" group.
This rule detects a high volume of group membership changes (additions or removals) by a single user within a one-hour window. Event IDs 4728 (A member was added to a security-enabled global group), 4729 (A member was removed from a security-enabled global group), and 4730 (A member was removed from a security-enabled universal group) are monitored. A count of 5 or more such events by the same user within an hour is flagged as suspicious, potentially indicating malicious account manipulation or privilege escalation attempts.
Page 11 of 18