Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
22
11
7
1
1
Contributors
8
7
5
4
4
Categories
13
12
12
9
8
Platforms
18
12
7
4
4
Products / Services
8
7
6
5
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
4
1
1
1
IDS Classtypes
6
1
IDS Protocols
4
2
1
Detects the creation or modification of Kubernetes ClusterRoles, ClusterRoleBindings, and RoleBindings, which can be used for privilege escalation within a Kubernetes cluster. The rule specifically flags activities related to 'cluster-admin' roles as critical and other administrative roles as high severity.
Detect remote login by Administrator user (depending on internal pattern).
Detects attempts to enable the guest account using the sysadminctl utility
Detects attempts to enable the root account via "dsenableroot"
Detects successful administrative logins ('vmanage-admin') to a Cisco SD-WAN device from an IP address not on the authorized list. This could indicate exploitation of CVE-2026-20127, an authentication bypass vulnerability.
This rule detects successful SSO logins on FortiGate devices using usernames and source IP addresses associated with a known malicious campaign exploiting a SAML SSO bypass. The rule specifically looks for successful SSO logins (logid == "0100032001", method == "sso", status == "success") from a predefined list of malicious usernames or source IP addresses.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
KQL Query from file: Identity Blast Radius 2
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: CVE-2024-26234 and CVE-2024-29988
KQL Query
KQL Query from file: Git Critical Vulnerability CVE-2024-32002
Detect remote login by Administrator user (depending on internal pattern).
Page 2 of 3