Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of account management commands such as user creation or group member modification initiated by or originating from 'ConfigurationRemotingServer.exe'. It also monitors for subsequent Windows Security Event IDs 4720 (User Account Created) and 4732 (Member added to local group) specifically targeting the 'Administrators' group, which indicates potential unauthorized administrative account or group membership manipulation.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
Detects successful assignment of highly privileged roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator) to a user in Microsoft Entra ID (formerly Azure AD). This is often a sign of privilege escalation or persistence establishment by an attacker.
This rule detects the creation of a new domain user account followed by its immediate addition to a privileged Active Directory group within a short timeframe. It specifically ignores common provisioning accounts and service accounts. A high risk score is assigned if the privileged group assignment occurs within 5 minutes of account creation, flagging potentially malicious account takeovers or privilege escalation activity.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
This rule monitors for suspicious administrative activity on Windows systems, specifically detecting the creation of new local user accounts (excluding machine accounts) and the addition of users to the local Administrators group.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
This rule detects HTTP POST requests to a MyBB forum administrative panel targeting the 'user-users' module, specifically attempting to assign a user to the 'Administrator' group (group ID 4). This pattern is indicative of an exploitation attempt or unauthorized administrative account manipulation.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
Detects when a user or service principal is assigned the 'Owner' or 'Contributor' role at the Subscription scope in Azure. This activity is often associated with privilege escalation and persistent access techniques.
User Added to an Administrator's Azure AD Role
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects the use of net.exe or net1.exe to create domain accounts or grant them administrative privileges (Domain Admins or Enterprise Admins) in Active Directory. This behavior is indicative of pre-ransomware persistence techniques employed by the Akira threat group, where attackers create specific service accounts and elevate their privileges before ransomware deployment.
Detects the creation of domain accounts named 'backup_DA' or 'backup_EA' and the subsequent addition of the 'backup_EA' account to the 'Enterprise Admins' group. This behavior is associated with the persistence and privilege escalation tactics used by the Akira ransomware group.
Page 9 of 18