Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
366 detections
Filters
Last updated
All Time
Detection languages
172
77
40
29
16
Contributors
84
57
41
29
27
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
188
56
46
38
37
Products / Services
123
40
32
27
26
MITRE Techniques
336
182
98
79
78
CVEs
8
7
6
5
5
IDS Classtypes
5
1
IDS Protocols
4
2
This rule monitors for high-impact configuration API calls and the creation of new administrator accounts within the Cisco Secure Firewall Management Center (FMC). These actions are indicative of post-exploitation activity related to CVE-2026-20079, which allows for authentication bypass. The detection focuses on sensitive administrative actions such as policy deployment, certificate exports, and user account creation which, if performed without valid session context, suggest an unauthorized actor.
Detects a sequence of suspicious activities including local account creation, modification of account security policies, and enabling of administrative services or credential exposure settings within a short time window. This typically indicates post-exploitation behavior where an adversary is attempting to establish persistence or facilitate further lateral movement.
Detects the use of common command-line utilities (net, powershell, cmd) to perform user account creation or local group membership modification, which are behaviors often associated with adversary persistence or privilege escalation.
Detects the creation of new administrator accounts or super_admin profiles on network devices such as firewalls from Fortinet, Cisco, Meraki, WatchGuard, and Sophos. This rule monitors log messages indicating administrative account provisioning, which is a potential indicator of unauthorized account manipulation or persistence attempts.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects potential persistence mechanisms in AWS by monitoring the creation of new IAM users or roles, the issuance of long-lived credentials (access keys or login profiles), or the creation of roles with permissive cross-account trust policies. This rule specifically excludes known legitimate automation roles to reduce noise.
This rule detects potential unauthorized account creation by correlating suspicious administrative activity on network edge devices (VPNs, firewalls) with subsequent local administrator account creation on an internal host within a one-hour window. This behavior is indicative of ransomware affiliates exploiting internet-facing infrastructure to gain initial access and escalate privileges.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
This rule monitors network device audit logs for suspicious activities that indicate potential persistence or defense evasion on edge/VPN/router appliances. It specifically flags configuration changes, creation of new administrative accounts, addition of unauthorized SSH keys, and the disabling of logging/syslog export, which are common tactics for maintainig unauthorized access on network infrastructure.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects the creation of an administrative-level user account (e.g., 'ops') on a MikroTik RouterOS device shortly after an anomalous login attempt using the '-2' username. This sequence is indicative of the exploit chain associated with specific MikroTik RouterOS vulnerabilities where an unauthenticated or specially crafted login is used to facilitate unauthorized user creation.
Detects the presence of an unauthorized administrative account (e.g., 'ops') on MikroTik RouterOS devices following a system 'Flagged' indicator. This rule correlates administrative account creation or modification events with system-reported compromise indicators to identify post-exploitation persistence mechanisms related to known RouterOS vulnerabilities.
Detects the creation of a new AWS IAM role with a trust policy that permits access from an external or wildcard principal, which is often used as a persistence mechanism to allow unauthorized cross-account access. The rule also triggers if an AdministratorAccess policy is attached to a newly created role, as these actions are commonly chained in cloud intrusions.
Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.
Detects the creation of a new local account that is immediately followed by (or associated with) execution from a process identified as an AI development or agent-based tool (e.g., Cursor, GitHub Copilot, Ollama). The rule correlates process creation events with Windows Security Event ID 4720 (User account created) and optionally checks for subsequent addition to the local Administrators group. This logic aims to surface potential unauthorized credential creation triggered by automated AI coding assistants or LLM-driven workflows.
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
Detects a sequence of events characteristic of exploitation against RouterOS (CVE-2026-67276/CVE-2026-86060), involving a failed SSH login attempt with the username '-2', followed by the creation of a new user account within the same SSH session, and a successful login with that newly created account.
Detects the creation of new administrator or technician accounts within the SimpleHelp Remote Monitoring and Management (RMM) platform via API calls. This activity is often associated with unauthorized persistence creation by an adversary who has gained access to the platform.
Page 2 of 18