Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
265 detections
Filters
Last updated
All Time
Detection languages
106
84
28
14
12
Contributors
69
38
34
21
19
Categories
181
134
87
62
38
Platforms
173
50
25
16
14
Products / Services
94
43
28
18
17
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
8
6
6
5
5
IDS Classtypes
2
1
IDS Protocols
1
1
Detects post-exploitation behavior where a PaperCut server Java process spawns local account creation or administrator reset followed closely by Active Directory enumeration on the same host, indicating potential post-RCE meterpreter activity.
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects creation of a new local administrative account on or through a
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
The following analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode 4732 (user added to Administrators group). This activity is significant as it indicates potential unauthorized privilege escalation, which is critical for SOC monitoring. If confirmed malicious, this could allow attackers to gain administrative access, leading to unauthorized data access, system modifications, and disruption of services. Immediate investigation is required to mitigate risks and prevent further unauthorized actions.
The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
The following analytic detects the rapid creation and deletion of Windows accounts within a short time frame of 1 hour. It leverages the "Change" data model in Splunk, specifically monitoring events with result IDs 4720 (account creation) and 4726 (account deletion). This behavior is significant as it may indicate an attacker attempting to create and remove accounts quickly to evade detection or gain unauthorized access. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further malicious actions within the environment. Immediate investigation of flagged events is crucial to mitigate potential damage.
The following analytic detects the creation of a new local user account on a Windows system. It leverages Windows Security Audit logs, specifically event ID 4720, to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk.
Detects the creation or modification of system users and groups on NetScaler ADC/Gateway appliances by monitoring Syslog events (e.g., nsconmsg, audit logs). The rule specifically triggers when these actions occur outside of standard business hours or on weekends, indicating potential unauthorized account manipulation or unauthorized persistence mechanisms.
Detects a sequence of suspicious activities including local account creation, modification of account security policies, and enabling of administrative services or credential exposure settings within a short time window. This typically indicates post-exploitation behavior where an adversary is attempting to establish persistence or facilitate further lateral movement.
Detects the use of common command-line utilities (net, powershell, cmd) to perform user account creation or local group membership modification, which are behaviors often associated with adversary persistence or privilege escalation.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Page 1 of 13