Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
16
4
1
1
1
Contributors
7
5
3
2
2
Categories
14
12
7
6
3
Platforms
17
3
2
1
1
Products / Services
8
8
6
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Windows AD User Added to Monitored Group
Cortex XDR
Detects Windows Security events (Event IDs 4728 and 4756) where a member is added to a sensitive or privileged Active Directory domain global or universal security group. The rule compares the target group against a locally maintained inventory of monitored groups to identify potential unauthorized privilege escalation or persistence.
Detects the addition of new domain accounts using the 'net group /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a domain environment.
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.
The group could be used to grant VPN access to a network.
This rule monitors for additions of users to highly sensitive Active Directory groups, such as Domain Admins or Enterprise Admins, by tracking specific Windows security events (4728, 4732, 4756). Unauthorized membership changes in these groups are a classic indicator of privilege escalation or persistence maintenance by an adversary.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
Detects the use of net.exe or net1.exe to add a local user account to the 'Administrators' or 'Remote Desktop Users' groups. This is a common technique used by attackers to gain persistent, elevated access or enable remote access to a compromised machine.
This rule monitors for additions of users to highly sensitive Active Directory groups, such as Domain Admins or Enterprise Admins, by tracking specific Windows security events (4728, 4732, 4756). Unauthorized membership changes in these groups are a classic indicator of privilege escalation or persistence maintenance by an adversary.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.
Detects local accounts being added to the Administrators group using net.exe, net1.exe, or cmd.exe.
Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
Detects when a user account is added to a high-privilege domain group (e.g., Domain Admins, Enterprise Admins, etc.)
Detects PowerShell commands using encoded command-line arguments to execute 'net user', 'net group', or 'net share' commands. This technique is often used by adversaries to obfuscate their actions and evade detection.
The SID S-1-5-32-544 refers to the builtin "Administrators" group on a local Windows machine. Threat actors will often reference this SID rather than the group name in order to obfuscate their actions. References to the SID rather than the group name should be considered unusual.
'Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed.
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
This query looks for local admin account used to logon into the computer.
This can help to detect malicious insiders that were able to add a local account to the local admin group offline.
This can help to detect malicious insiders that were able to add a local account to the local admin group offline.
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
'Compares the current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by Azure Apps and automated approvals.'
Look for adding a user to Administrators in remote desktop users via PowerShell.
Page 1 of 2