Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
Detects the addition of new domain accounts using the 'net group /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a domain environment.
User All Event Log Activity
Cortex XDR
This rule monitors Windows event logs for activity involving the SAM account name, which may indicate account enumeration, credential access attempts, or malicious modifications to account security settings.
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
Detects configuration events in BeyondTrust Password Safe where a user is added to a group containing 'Administrators' in its name. This behavior can indicate unauthorized privilege escalation or persistence within the BeyondInsight/Password Safe environment.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
This rule detects the addition of a user to a security-enabled global group in Active Directory by monitoring Windows Security Event ID 4728. This event occurs when an account is added to a security-enabled global group, which is a common action during privilege escalation or persistence phases.
This KQL is designed to hunt for activity that may indicate Active Directory Certificate Services abuse or Certighost-like domain compromise behavior, especially where an attacker may manipulate machine account attributes, impersonate domain-controller-like behavior, or perform follow-on credential extraction.
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
This KQL detects possible impossible travel sign-in patterns by identifying users who had successful Entra ID sign-ins from different countries within a short time window of 4 hours.
Identifies Azure AD service principal credentials (KeyId) that have been continuously used for 90 or more days without rotation, surfacing long-lived static API keys/credentials that increase exposure risk to token jacking, credential theft, or gray-market resale of AI/API access.
Five or more service account keys created by the same principal, indicating mass credential generation.
Detects developer accounts whose daily count of API key creation or model provisioning operations exceeds their own 15-day historical per-user baseline plus several standard deviations, excluding service principals/apps, which may indicate compromised credentials being abused to provision or harvest AI API keys for resale (token jacking).
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
This rule detects the deletion or disabling of Google Cloud IAM service accounts in GCP Audit Logs. These actions are often associated with cleanup activities by an adversary trying to remove persistence or hinder forensic investigations and incident response.
Five or more service account keys created by the same principal inside a 1 hour time bucket, indicating potential mass credential generation.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects a successful FortiCloud SSO administrative login to a Fortinet appliance followed by the creation of a local administrator account from the same source IP and user within 15 minutes.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
The query uses Fortinet CEF events available in CommonSecurityLog and correlates the appliance, administrative user, and source IP to reduce unrelated administrative activity. This behavior is associated with post-exploitation activity observed for CVE-2026-24858.
Bu sorgudaki temel saldırı zinciri, Microsoft Azure-Sentinel deposundaki
"CVE Exploitation Indicators on Network Appliance (3P)" hunting sorgusunda
bulunan FortiCloud SSO oturumu ile admin hesabı oluşturma korelasyonundan
esinlenilerek hazırlanmıştır.
Page 13 of 40