Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
265 detections
Filters
Last updated
All Time
Detection languages
106
84
28
14
12
Contributors
69
38
34
21
19
Categories
181
134
87
62
38
Platforms
173
50
25
16
14
Products / Services
94
43
28
18
17
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
8
6
6
5
5
IDS Classtypes
2
1
IDS Protocols
1
1
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.
This rule monitors for suspicious administrative activity on Windows systems, specifically detecting the creation of new local user accounts (excluding machine accounts) and the addition of users to the local Administrators group.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
This rule detects the creation of new user accounts via the Windows 'net user' command or Windows Security Event 4720 where the account name or command line arguments contain the string 'rage_master_'. This pattern suggests the potential creation of an unauthorized or backdoor account, possibly related to a specific naming convention used by an actor or a naming collision with malicious activity.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
This rule detects the rapid creation of a new user account followed immediately by that user being added to a high-privilege group (specifically those containing 'administrators' or 'remote desktop users') within a 60-second window. It monitors Windows Security event logs for Event IDs 4720 (User Account Created) and 4732 (Member added to security-enabled local group).
Detects rapid creation of multiple user accounts within a one-hour window. This behavior can be indicative of malicious activity, such as an attacker creating persistence accounts or staging multiple accounts for lateral movement or automated attacks.
Detects the use of Windows Package Manager utilities (winget.exe, WindowsPackageManagerServer.exe) or ConfigurationRemotingServer.exe to execute administrative commands related to local user and group management, such as adding users or modifying group memberships. This behavior is highly irregular for these binaries and suggests potential abuse for persistence or privilege escalation.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new user account with administrator privileges (group 4). This rule identifies when an account with limited management permissions exploits the ACP to assign a new user to the administrator group, effectively bypassing intended permission restrictions.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
Detects the creation of a local user account (Event ID 4720) where the account name mimics system service accounts such as 'svchost', 'lsass', or 'winlogon'. Adversaries often use such names to blend into legitimate system activity and avoid detection.
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Detects rapid creation of multiple user accounts within a one-hour window. This behavior can be indicative of malicious activity, such as an attacker creating persistence accounts or staging multiple accounts for lateral movement or automated attacks.
Page 6 of 13