Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
37
16
7
5
4
Contributors
18
13
6
5
4
Categories
48
25
18
16
16
Platforms
61
8
6
4
3
Products / Services
38
21
11
7
6
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
2
2
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the creation of new domain user accounts using the 'net user /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a Windows domain environment.
Detects the addition of new domain accounts using the 'net group /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a domain environment.
New User Creation Monitoring For On-Prem
Cortex XDR
This rule detects the creation of a new user account in Active Directory by monitoring for Windows Security Event ID 4720. It extracts the target username, target domain, and the user who performed the account creation to provide context for investigation.
This query is trying to identify cases where a newly created machine account may correspond to a device that quickly begins exposing domain-controller-like services, especially LDAP and SMB.
Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
This rule detects when a previously disabled Active Directory user account is re-enabled. Monitoring for account enablement is critical as it can be a sign of an adversary reactivating a dormant or service account to maintain persistence or conduct lateral movement.
This rule detects when a previously disabled Active Directory user account is re-enabled. Monitoring for account enablement is critical as it can be a sign of an adversary reactivating a dormant or service account to maintain persistence or conduct lateral movement.
This rule monitors for new user account creation (Event ID 4720) that is either performed by a known suspicious process name or initiated by a non-standard provisioning account. It additionally correlates these creation events with subsequent additions of the new account to the local Administrators group (Event ID 4732) to flag potential privilege escalation attempts.
This rule detects the creation of a new domain user account followed by its immediate addition to a privileged Active Directory group within a short timeframe. It specifically ignores common provisioning accounts and service accounts. A high risk score is assigned if the privileged group assignment occurs within 5 minutes of account creation, flagging potentially malicious account takeovers or privilege escalation activity.
Detects the use of PowerShell to spawn 'net.exe' for the purpose of creating new domain accounts, modifying existing account properties, or escalating privileges by adding users to high-privilege groups such as Enterprise Admins. This activity is consistent with known Akira ransomware intrusion patterns, specifically aimed at establishing persistence or escalating privileges within a domain environment.
This rule detects the creation of new user accounts via the Windows 'net user' command or Windows Security Event 4720 where the account name or command line arguments contain the string 'rage_master_'. This pattern suggests the potential creation of an unauthorized or backdoor account, possibly related to a specific naming convention used by an actor or a naming collision with malicious activity.
Detects the use of net.exe or net1.exe to create domain accounts or grant them administrative privileges (Domain Admins or Enterprise Admins) in Active Directory. This behavior is indicative of pre-ransomware persistence techniques employed by the Akira threat group, where attackers create specific service accounts and elevate their privileges before ransomware deployment.
Detects the creation of domain accounts named 'backup_DA' or 'backup_EA' and the subsequent addition of the 'backup_EA' account to the 'Enterprise Admins' group. This behavior is associated with the persistence and privilege escalation tactics used by the Akira ransomware group.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
This rule detects the rapid creation of a new user account followed immediately by that user being added to a high-privilege group (specifically those containing 'administrators' or 'remote desktop users') within a 60-second window. It monitors Windows Security event logs for Event IDs 4720 (User Account Created) and 4732 (Member added to security-enabled local group).
Detects rapid creation of multiple user accounts within a one-hour window. This behavior can be indicative of malicious activity, such as an attacker creating persistence accounts or staging multiple accounts for lateral movement or automated attacks.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
Page 2 of 4