Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
27
13
7
7
2
Contributors
18
10
7
6
4
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
33
14
4
3
2
Products / Services
27
9
7
3
3
MITRE Techniques
37
25
24
21
21
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
Detects bulk deletion or disabling of accounts to lock out defenders
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
Detects when a user account is deleted on a Windows system. This event (EventID 4726) is critical for monitoring potential malicious activity, such as an attacker attempting to remove traces of their presence or disrupt operations by deleting legitimate user accounts.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.
Detects when an account was created and deleted in a short period of time.
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
Detects when a security-enabled global group is deleted in a Windows environment. This activity can be indicative of an adversary attempting to remove traces of their presence or disrupt normal operations by deleting critical groups.
Detects activity when a security-enabled global group is deleted
The following analytic detects the rapid creation and deletion of Windows accounts within a short time frame of 1 hour. It leverages the "Change" data model in Splunk, specifically monitoring events with result IDs 4720 (account creation) and 4726 (account deletion). This behavior is significant as it may indicate an attacker attempting to create and remove accounts quickly to evade detection or gain unauthorized access. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further malicious actions within the environment. Immediate investigation of flagged events is crucial to mitigate potential damage.
Page 2 of 3