Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
265 detections
Filters
Last updated
All Time
Detection languages
106
84
28
14
12
Contributors
69
38
34
21
19
Categories
181
134
87
62
38
Platforms
173
50
25
16
14
Products / Services
94
43
28
18
17
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
8
6
6
5
5
IDS Classtypes
2
1
IDS Protocols
1
1
Detects the creation of local user accounts using the Windows net.exe utility, specifically looking for accounts containing the 'rage_master_' naming convention, often used by adversaries or automated tools for maintaining persistent access.
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
Detects the creation of a new local user account on a Windows system using the net.exe or net1.exe command-line utilities. This is a common technique used by attackers for establishing persistent access to a compromised system.
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Detects the creation of a local user account (EventID 4720) or the addition of a user to sensitive local groups such as Administrators or Remote Desktop Users (EventID 4732). This behavior is common in persistence mechanisms used by threat actors such as BQTLock ransomware and GOLD ENCOUNTER.
Detects the use of Windows Package Manager (winget) or Configuration Remoting Server processes to execute account management commands such as adding users or modifying group memberships via net.exe or PowerShell. This behavior is indicative of privilege escalation or persistence attempts using legitimate administrative tools.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.
The new local user could be used for VPN connections.
This rule detects suspicious activity on Linux systems including unauthorized modification of SSH authorized_keys, creation of unauthorized system accounts (e.g., 'troot'), manipulation of critical system files like /etc/passwd or /etc/shadow, and the execution of specific suspicious scripts or commands indicative of an exploit or post-exploitation activity.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
This rule monitors for new user account creation (Event ID 4720) that is either performed by a known suspicious process name or initiated by a non-standard provisioning account. It additionally correlates these creation events with subsequent additions of the new account to the local Administrators group (Event ID 4732) to flag potential privilege escalation attempts.
This rule detects the creation and subsequent deletion of a local user account within a 240-minute window. This behavior is often indicative of an adversary creating a temporary, ephemeral account for malicious activity (e.g., persistence or lateral movement) and then removing it to evade detection or cover their tracks.
Detects the creation of local user accounts or adding users to privileged groups triggered by ConfigurationRemotingServer.exe. This activity is indicative of potential misuse of the WinGet DSC (Desired State Configuration) capability to maintain persistence or escalate privileges on a Windows host, a technique observed in the DSCourier malware.
This rule detects the execution of account management commands such as user creation or group member modification initiated by or originating from 'ConfigurationRemotingServer.exe'. It also monitors for subsequent Windows Security Event IDs 4720 (User Account Created) and 4732 (Member added to local group) specifically targeting the 'Administrators' group, which indicates potential unauthorized administrative account or group membership manipulation.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Page 5 of 13