Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
86
27
13
10
7
Contributors
26
20
15
12
9
Categories
78
60
32
22
21
Platforms
44
41
24
23
17
Products / Services
26
16
15
14
13
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
5
5
5
4
IDS Classtypes
1
1
IDS Protocols
1
FortiGate Local User Account Created
Cortex XDR
Detects the creation of a new locally defined user account on a FortiGate device by monitoring configuration change logs. Unauthorized local accounts can be used to establish persistent, unauthorized access to network infrastructure.
Windows Multiple User Account Creations
Cortex XDR
Detects five or more distinct Windows user-account creation events (Event ID 4720) associated with the same actor and host within a one-hour time bucket, which may indicate unauthorized account creation for persistence or mass provisioning.
Detects the creation of new domain user accounts using the 'net user /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a Windows domain environment.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule detects potentially malicious modifications to agent configurations by monitoring for multiple significant changes within a short time frame (2 days) compared to a 14-day baseline. Monitored indicators include: changes to instructions, addition of new Model Context Protocol (MCP) servers, addition of new owners, and expansion of access permissions to include the entire organization. An alert is triggered when an agent exhibits at least two of these signals simultaneously.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
The query builds a 14-day baseline snapshot and a 2-day current snapshot per agent from AgentsInfo, computes the four signals independently, then correlates them by AgentId and surfaces only agents with 2 or more signals firing in the same window. Output is a prioritized triage list instead of four separate alert streams.
This rule detects the creation of a local user account named _BootUEFI_ and its addition to the Remote Desktop Users group, followed by RemoteInteractive logons using that account. This behavior is indicative of an RDP backdoor mechanism associated with the HeptaX campaign.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of Azure Container Registry (ACR) scoped access tokens or scope maps. Adversaries may use these features to establish persistent, least-privileged access to registry resources, often bypassing standard authentication monitoring.
Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.
This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.
Detects instances where a user account is created and subsequently deleted within 24 hours. This behavior may indicate an adversary creating a temporary account for lateral movement, privilege escalation, or establishing persistence that is intended to be short-lived.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
Detects instances where a user account is created and subsequently deleted within 24 hours. This behavior may indicate an adversary creating a temporary account for lateral movement, privilege escalation, or establishing persistence that is intended to be short-lived.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects cross-tenant service principal authentications that leverage blueprint-derived identities. This rule specifically looks for client_credentials grant types using client_assertion (JWT bearer) or client_secret targeting sensitive scopes like 'api://AzureADTokenExchange/.default' or 'AgentIdentity.CreateAsManager' from a foreign tenant service principal. This activity could indicate an attempt to establish persistence or gain unauthorized access across Azure AD tenants.
Page 3 of 7