Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects when a user is added to a group that has permissions to modify Conditional Access (CA) policies within Azure Active Directory. Such an action could indicate an attempt to escalate privileges, bypass existing security controls, or establish persistence by altering authentication processes.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
Detects the addition of users to the local 'Remote Desktop Users' group using either the 'net localgroup' command or the 'Add-LocalGroupMember' PowerShell cmdlet. This activity can indicate an adversary attempting to establish persistence or facilitate lateral movement via Remote Desktop Protocol.
This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.
Detects activity when a member is added to a security-enabled global group
Detects activity when a member is removed from a security-enabled global group
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Detects when a user account is added to a high-privilege domain group (e.g., Domain Admins, Enterprise Admins, etc.)
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
Detects a user self-assigning access to a large number of applications in Okta within a short time frame. This behavior is associated with the threat group UNC3944 (Scattered Spider) for privilege escalation and lateral movement across SaaS applications.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
Detects the addition of a member to a sensitive Active Directory group related to VMware administration (e.g., 'vSphere Admins', 'ESX Admins') using net.exe executed via WinRM (wsmprovhost.exe). This behavior is a key TTP used by threat groups like UNC3944 to escalate privileges and gain control over the vSphere environment after an initial compromise.
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.
KQL Query
Page 15 of 18