Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
A regular user account performed rapid, repeated password changes across multiple local accounts within a 2-second window.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
This pattern is consistent with automated credential manipulation tools that cycle account passwords to deny access to defenders or escalate privileges The speed and volume of changes indicates scripted or tooled activity rather than manual administration, as legitimate password resets do not occur at machine speed across multiple accounts simultaneously.
Detects successful Microsoft Entra RoleManagement activity where a member is assigned permanently to a role outside of Privileged Identity Management (PIM). This is flagged as a privileged access risk because it bypasses just-in-time eligibility and activation controls.
Windows AD User Added to Monitored Group
Cortex XDR
Detects Windows Security events (Event IDs 4728 and 4756) where a member is added to a sensitive or privileged Active Directory domain global or universal security group. The rule compares the target group against a locally maintained inventory of monitored groups to identify potential unauthorized privilege escalation or persistence.
Detects modifications to Windows user accounts where the 'Password Never Expires' flag is enabled. This modification, often represented by the DONT_EXPIRE_PASSWORD userAccountControl flag (Event ID 4738), may indicate an attempt to establish persistence or weaken credential lifecycle security by bypassing password rotation requirements.
Detects the creation of a new role-based access control (RBAC) role within the Cortex management plane. This activity is significant as new roles can define access to sensitive administrative and security capabilities and should be reviewed to ensure alignment with least-privilege principles and authorized access-management requirements.
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option.
When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring.
This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period.
If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option.
When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring.
This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period.
If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.
Windows Multiple User Accounts Disabled
Cortex XDR
Detects five or more distinct Windows user-account disable events (Event ID 4725) performed by the same actor on the same host within a one-hour time bucket, which may indicate unauthorized account access removal.
Detects high-risk administrative actions within Netskope, including the deletion of security policies, modification of Data Loss Prevention (DLP) rules, disabling of threat protection features, or the creation of new API tokens and administrative accounts. The rule flags these activities as 'critical' or 'high' severity, particularly if they occur outside standard business hours.
This rule monitors and aggregates Microsoft Entra ID Privileged Identity Management (PIM) group activation logs to provide a dashboard view of group usage, member count, and recent role activations. It facilitates governance by identifying high-usage, low-usage, or unused PIM-eligible groups by correlating historical and recent activation activity with current membership data.
Detects modifications to the 'userPrincipalName' attribute in Active Directory via Security Event ID 5136 where the assigned value lacks an '@' character. This behavior is indicative of the ResetNightmare exploitation technique (CVE-2026-27912), which involves setting the UPN to a bare sAMAccountName to facilitate unauthorized password resets or account takeover.
KQL Query
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
Detects Microsoft Entra audit activity where a service principal is granted high-impact application permissions, such as directory, application, group, mail, file, or role-management write access. This activity is significant as compromised applications can leverage these permissions to perform actions without requiring an interactive user.
Detects modifications to BeyondTrust Password Safe administrative groups. This activity is critical to monitor as it can indicate an unauthorized attempt to alter privileged access models or maintain persistence by modifying identity permissions within the BeyondTrust environment.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
Page 12 of 40