Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
86
27
13
10
7
Contributors
26
20
15
12
9
Categories
78
60
32
22
21
Platforms
44
41
24
23
17
Products / Services
26
16
15
14
13
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
5
5
5
4
IDS Classtypes
1
1
IDS Protocols
1
This detection correlates suspicious device code authentication behaviour in Azure AD with a successful creation of a Windows Hello for Business (WHfB) credential within the same 24 hours.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
Detects the creation of a new administrative account with 'prof_admin' privileges on a FortiWeb device from an unknown IP address. This activity is highly suspicious if not performed by a known administrator and could indicate post-exploitation activity, potentially related to CVE-2025-64446.
Detects the creation of new user accounts within Okta. This rule specifically looks for the 'user.lifecycle.create' event type in Okta logs, indicating that a new user account has been provisioned in the identity management system.
This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Detects PowerShell commands using encoded command-line arguments to execute 'net user', 'net group', or 'net share' commands. This technique is often used by adversaries to obfuscate their actions and evade detection.
This analytic detects the creation of privileged user accounts or the elevation of existing accounts to privilege level 15 (the highest administrative privilege level) on Cisco IOS devices. This activity is suspicious as it could indicate an attacker establishing backdoor access or persistence after gaining initial access, potentially through vulnerabilities like CVE-2018-0171. The rule specifically looks for commands related to setting user privilege to 15, modifying user passwords in conjunction with user table modifications, or explicit privilege updates to level 15.
The analytic detects the creation of a new Azure Automation account within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when an account is created or updated. This activity is significant because Azure Automation accounts can be used to automate tasks and orchestrate actions across Azure and on-premise environments. If an attacker creates an Automation account with elevated privileges, they could maintain persistence, execute malicious runbooks, and potentially escalate privileges or execute code on virtual machines, posing a significant security risk.
Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
Detects scenarios where an attacker creates a computer account with privileges for later exploitation.
Detects scenarios where an attacker would abuse some privileges while realying host credentials to escalate privileges.
Detects scenarios where an attacker abuse MachineAccountQuota privilege and pre-create a computer object for abusing RBCD delegation.
Detects scenarios where an attacker enables a disabled builtin account.
Detects scenarios where an attacker attempts to create a user via commandline.
Detects scenarios where an attacker creates a user account that fakes a computer account.
Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.
KQL Query
KQL Query from file: ATP Detection for Critical Identities
KQL Query from file: Detect Copilot Plugin Installation
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
Page 5 of 7