Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
Provides a role-centric view of Microsoft Entra Privileged Identity Management (PIM) usage by correlating role eligibility, activation history, and recently activated assignments.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
This rule monitors and aggregates Microsoft Entra ID Privileged Identity Management (PIM) group activation logs to provide a dashboard view of group usage, member count, and recent role activations. It facilitates governance by identifying high-usage, low-usage, or unused PIM-eligible groups by correlating historical and recent activation activity with current membership data.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
This rule detects the addition of a user to a security-enabled global group in Active Directory by monitoring Windows Security Event ID 4728. This event occurs when an account is added to a security-enabled global group, which is a common action during privilege escalation or persistence phases.
This rule monitors Windows Security Event Logs for Event IDs 4728 and 4729, which indicate that a security-enabled global group has had a member added or removed, respectively. By aggregating these changes by group name and event action, it provides a summary of administrative activity regarding Active Directory group membership changes over a 365-day period.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
Detects potential persistence mechanisms involving 'IBM SPSS WinWrap Basic IDE' or 'WinWrapIDE.exe'. The rule monitors for the creation of a scheduled task, registry run key additions, or event ID 4698 (scheduled task creation) associated with these artifacts. It further correlates these activities with suspicious account creation events (Event IDs 4720, 4732) on the same device within a one-hour window.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.
This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.
AD Group Changes and Membership Activity
Cortex XDR
This rule monitors Active Directory security event logs for modifications to local, global, and universal groups. It specifically tracks events related to the creation, deletion, and membership changes of AD groups, providing visibility into potential privilege escalation or unauthorized administrative activity within the domain.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects the creation of a local user account named _BootUEFI_ and its addition to the Remote Desktop Users group, followed by RemoteInteractive logons using that account. This behavior is indicative of an RDP backdoor mechanism associated with the HeptaX campaign.
Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.
detects manual additions to local Administrators, Remote Desktop Users, and Remote Management Users groups, resolving member SIDs to display names via AD sync, host inventory, and well-known SID mapping, with machine account and FQDN deduplication built in.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
Detects attempts to exploit an authorization bypass vulnerability in MyBB (specifically observed in version 1.8.40) where a non-administrative ACP account can assign users to the administrator group (gid=4) by manipulating POST requests to the user-add or user-edit endpoints.
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
Page 7 of 18