Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
436
190
77
62
40
Contributors
120
114
72
71
68
Categories
462
233
193
152
120
Platforms
288
272
154
88
56
Products / Services
220
169
162
90
74
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
837
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects scenarios where an attacker perform a password reset event. This does not require any knowledge of a user’s current password, but it does require to have the "Reset Password" right. Correlate the event ID 4724, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.
Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
Detects scenarios where an attacker set an account with reversible encryption to facilitate brutforce or cracking operations.
Detects scenarios where an attacker set an account with DES Kerberos encryption to perform ticket brutforce.
Detects scenarios where an account password is set to never expire.
Detects scenarios where an attacker creates a user account that fakes a computer account.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where a new member is added to a sensitive group related to Exchange server
Detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker adds a SPN to an account in order to perform different type of abuse (Kerberoast, delegation abuse, ...)
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
Detects scenarios where a suspicious group membership is changed.
Detects scenarios where a suspicious group membership is changed.
Page 31 of 40