Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
'This query detects all authentication attempts of non administrator accounts that their RID is ending in *-500.
Ref: https://stealthbits.com/blog/rid-hijacking-when-guests-become-admins/'
Ref: https://stealthbits.com/blog/rid-hijacking-when-guests-become-admins/'
