Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
2
1
1
Categories
3
2
2
1
1
Platforms
4
1
Products / Services
2
1
1
MITRE Techniques
4
3
3
3
3
CVEs
71
71
64
58
49
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
Detects when the Windows Admin Center service ('SmeSvc.exe') is stopped, and shortly thereafter, a different process starts listening on the WAC port (TCP/6516). This behavior is a key indicator of CVE-2026-20965 exploitation, where an attacker impersonates the service to steal administrator access tokens.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
