Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation of new local user accounts or the addition of existing accounts to the local Administrators group on Windows systems. It specifically looks for Windows Security Event IDs 4720 (A user account was created) and 4732 (A member was added to a security-enabled local group) or 4728 (A member was added to a security-enabled global group) or 4756 (A member was added to a security-enabled universal group), filtering for 'User' account types and ensuring that for Event ID 4732, the group is the 'Administrators' group (identified by SID S-1-5-32-544 or group name). This activity can indicate an adversary establishing persistence or escalating privileges.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This rule detects when a guest user from a common public email domain (e.g., gmail.com, outlook.com) is invited to an Azure Active Directory (AAD) tenant and subsequently added to an AAD security group. This could indicate an attempt to grant unauthorized access to an external account or a misconfiguration allowing guest users to be added to sensitive groups.
Detects local accounts being added to the Administrators group using net.exe, net1.exe, or cmd.exe.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
This rule detects when a member is added to or removed from highly sensitive administrative groups within Active Directory. It specifically monitors Windows Security Event IDs 4728 (member added) and 4729 (member removed) for a predefined list of critical groups such as 'Administrators', 'Domain Admins', 'Enterprise Admins', and 'Schema Admins'. The rule excludes changes made by computer accounts to reduce false positives.
Detects the creation of a new domain user account that is immediately added to a high-privilege group, such as Domain Admins. This pattern is a strong indicator of persistence and privilege escalation, as observed in the Lynx Ransomware campaign.
Detects a user account creation event followed by that same account being added to a privileged administrative group within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the group addition event.
Detects a user account creation event in Azure AD followed by that same account being added to a privileged administrative role within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the role addition event.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects when a new administrator role assignment is created within Okta. This activity can indicate privilege escalation, where an attacker gains higher-level permissions, or persistence, where an attacker establishes a way to maintain access to the system over time.
Detects when an administrator role is assigned to a user or group within Okta. This could indicate privilege escalation or persistence by an attacker, or a legitimate administrative action.
This rule detects when a user is added to the local 'admin' group on a macOS system using either the `dscl` or `dseditgroup` command-line utilities. It specifically looks for command-line arguments indicative of adding a user to the 'admin' group. There is a whitelist for legitimate MDM solutions like 'jamfmanager' to reduce false positives.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
This rule detects when a user is added to an administrator's role within Azure Active Directory. This is a critical event as it grants elevated privileges to the user, which could be abused for malicious purposes such as persistence, privilege escalation, or initial access. The detection specifically looks for 'Add member to role.' operations in AzureActiveDirectory workload where the new role value ends with 'Admins' or 'Administrator'.
This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.
This rule detects when a user is removed from a group that has Conditional Access (CA) policy modification access within Azure Active Directory. Such groups are critical for managing access to resources, and unauthorized removal of members could indicate an attempt to evade detection, disrupt security controls, or prepare for further malicious activity. Monitoring these removals helps identify potential privilege escalation, defense evasion, or persistence attempts.
This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
This rule detects when a new member is added to a security-enabled global group in a Windows environment. This activity is significant because adding users to such groups can grant them elevated privileges or access to sensitive resources, making it a common action for adversaries attempting privilege escalation or persistence.
Page 14 of 18