Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
26
4
2
Contributors
12
7
4
4
2
Categories
11
10
8
6
5
Platforms
21
9
2
2
2
Products / Services
14
6
5
5
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
Detects when a user account's 'UserAccountControl' attribute is modified to include the 'Not Delegated' flag (EventID 4738). This change can be an indicator of an attacker attempting to alter account behavior for persistence or to evade detection, or it could be a legitimate administrative action.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
Detects when a user account's 'UserAccountControl' attribute is modified to include the 'Not Delegated' flag (EventID 4738). This change can be an indicator of an attacker attempting to alter account behavior for persistence or to evade detection, or it could be a legitimate administrative action.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects when a certificate is issued to a privileged user. It identifies privileged users by checking their group membership against a predefined list of administrative groups such as 'Domain Admins', 'Enterprise Admins', and 'Administrators'. The rule then looks for Windows Security Event ID 4886, which indicates a certificate services operation, and extracts the principal name from the Subject Alternative Name field. Finally, it joins this information with the identified privileged users to flag any certificate issuance to them.
This KQL query analyzes Microsoft Entra ID (formerly Azure AD) sign-in and audit logs to identify potentially risky multi-factor authentication (MFA) registration events. It works by checking for MFA registrations initiated from a new, previously unseen IP address.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
KQL Query
KQL Query from file: Entra QR Code Sign-In KQL Detection
KQL Query from file: Sentinel All-In-One UPN ThreatHunt
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
This query shows all modifications to highly sensitive active directory groups (also known as Tier 0). An example of these groups include Domain Admins, Schema Admins and Enterprise Admins.
More info can be found here:
https://docs.microsoft.com/security/compass/privileged-access-access-model#evolution-from-the-legacy-ad-tier-model
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
This advanced hunting query requires Defender for Identity be deployed due to it's reliance on the IdentityDirectoryEvents table.
More info can be found here:
https://docs.microsoft.com/security/compass/privileged-access-access-model#evolution-from-the-legacy-ad-tier-model
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
This advanced hunting query requires Defender for Identity be deployed due to it's reliance on the IdentityDirectoryEvents table.
'This query detects domain user accounts creation (event ID 4720) where the username ends with $.
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
'This query looks for accounts being created that do not have attributes populated that are commonly populated in the tenant.
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts.
Created accounts should be investigated to ensure they were legitimated created.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#accounts-not-following-naming-policies'
'Identifies when a user account was created and then added to the builtin Administrators group in the same day.
This should be monitored closely and all additions reviewed.'
This should be monitored closely and all additions reviewed.'
Page 1 of 2