Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
37
16
7
5
4
Contributors
18
13
6
5
4
Categories
48
25
18
16
16
Platforms
61
8
6
4
3
Products / Services
38
21
11
7
6
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
2
2
1
1
IDS Classtypes
1
IDS Protocols
1
This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory.
This rule monitors for high-impact configuration API calls and the creation of new administrator accounts within the Cisco Secure Firewall Management Center (FMC). These actions are indicative of post-exploitation activity related to CVE-2026-20079, which allows for authentication bypass. The detection focuses on sensitive administrative actions such as policy deployment, certificate exports, and user account creation which, if performed without valid session context, suggest an unauthorized actor.
Detects the use of common command-line utilities (net, powershell, cmd) to perform user account creation or local group membership modification, which are behaviors often associated with adversary persistence or privilege escalation.
Detects the creation of new administrator accounts or super_admin profiles on network devices such as firewalls from Fortinet, Cisco, Meraki, WatchGuard, and Sophos. This rule monitors log messages indicating administrative account provisioning, which is a potential indicator of unauthorized account manipulation or persistence attempts.
This rule detects potential unauthorized account creation by correlating suspicious administrative activity on network edge devices (VPNs, firewalls) with subsequent local administrator account creation on an internal host within a one-hour window. This behavior is indicative of ransomware affiliates exploiting internet-facing infrastructure to gain initial access and escalate privileges.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects instances where a non-administrative user account creates two or more computer accounts within a 24-hour window. This behavior can be indicative of a compromised account attempting to add rogue machines to the domain for persistence or further lateral movement.
Detects unauthorized creation of a WordPress administrator account through direct SQL injection or manual database modification by monitoring for insertions into the 'wp_users' table or modifications to the 'wp_usermeta' table with 'administrator' capabilities.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Adversaries may create a domain account to maintain access to victim systems.
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.
Detects the creation of a new domain user followed by its addition to sensitive, high-privileged groups (e.g., Domain Admins, Enterprise Admins) using the native Windows net.exe or net1.exe utilities. This pattern aligns with known post-compromise activity observed in campaigns like Bumblebee, AdaptixC2, and Akira ransomware, where attackers create stealthy, elevated accounts (e.g., masquerading as backup service accounts) to maintain persistence and full domain control.
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Detects the use of 'net.exe' or 'net1.exe' to add a user to the 'Enterprise Admins' group, which is a highly privileged Active Directory group. This activity is indicative of privilege escalation and persistence attempts by an adversary to gain full control over the domain.
Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces)
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
using either the WinNT or LDAP provider. This is an uncommon method to create user accounts
and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Detects the creation of domain user accounts using the native 'net.exe' or 'net1.exe' utilities with command-line arguments that include '/add', '/dom', and naming conventions indicating 'backup_DA' or 'backup_EA'. This pattern is often associated with adversary attempts to establish persistence or backdoors using privileged service-like account names.
Windows Multiple User Account Creations
Cortex XDR
Detects five or more distinct Windows user-account creation events (Event ID 4720) associated with the same actor and host within a one-hour time bucket, which may indicate unauthorized account creation for persistence or mass provisioning.
Page 1 of 4