Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
27
13
7
7
2
Contributors
18
10
7
6
4
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
33
14
4
3
2
Products / Services
27
9
7
3
3
MITRE Techniques
37
25
24
21
21
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
' This query will detect logins from guest account which was recently deleted.
For any successful logins from deleted identities should be investigated further if any existing user accounts have been altered or linked to such identity prior deletion'
For any successful logins from deleted identities should be investigated further if any existing user accounts have been altered or linked to such identity prior deletion'
'Identifies when a user account is created and then deleted within 10 minutes. This can be an indication of compromise and an adversary attempting to hide in the noise.'
Find accounts that have been deleted and by whom
This query calculates device uptime based on periodic DeviceInfo which is recorded every 15 minutes regardless of device's network connectivity and uploaded once device gets online. If its interval is over 16 minutes, we can consider device is turned off.Calculated uptime may include up to 30 minutes gap. Devices may be turned on up to 15 minutes earlier than the "timestamp", and may be turned off up to 15 minutes later than the "LastTimestamp". When the single independent DeviceInfo without any sequential DeviceInfo within 16 minutes before or after is recorded, "DurationAtLeast" will be displayed as "00.00:00:00".
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
Detects the creation, login, and deletion of a user account over a predefined timeframe
This analytic detects the creation, deletion, or modification of the "ESX Admins" group in Active Directory. These events may indicate attempts to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085).
The analytic detects the deletion of more than five unique Windows accounts within a 10-minute period, using Event Code 4726 from the Windows Security Event Log. This activity is significant as it may indicate an attacker attempting to erase traces of their actions. If confirmed malicious, this could lead to unauthorized access removal, hindering incident response and forensic investigations.
The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Identifies when a service account is disabled or deleted in Google Cloud.
Page 3 of 3