Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects signs of persistence via account manipulation consistent with the Obsidian Sandstorm actor. The rule monitors for unauthorized password resets on administrative accounts (Event IDs 4723, 4724), the addition of users to highly privileged security groups (Event IDs 4728, 4732), and modifications to user account attributes (Event ID 4738) that indicate changes in account control flags.
Detects instances where an interactive user initiates a password change attempt as captured by Windows Security Event ID 4723. The rule filters out non-interactive accounts (ending with '$') and common service account naming patterns to focus on human-driven account modifications.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
Threat hunting query designed to identify suspicious FortiGate SSL-VPN and administrative authentication activity that may indicate credential abuse following the FortiBleed 2026 credential exposure campaign.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
Detects when a user account is deleted on a Windows system. This event (EventID 4726) is critical for monitoring potential malicious activity, such as an attacker attempting to remove traces of their presence or disrupt operations by deleting legitimate user accounts.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
This rule monitors for suspicious administrative activity on Windows systems, specifically detecting the creation of new local user accounts (excluding machine accounts) and the addition of users to the local Administrators group.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
This rule detects HTTP POST requests to a MyBB forum administrative panel targeting the 'user-users' module, specifically attempting to assign a user to the 'Administrator' group (group ID 4). This pattern is indicative of an exploitation attempt or unauthorized administrative account manipulation.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
Detects modifications to the AdminSDHolder object in Active Directory via Windows Security Event ID 5136. The AdminSDHolder object maintains the security permissions for all objects protected by the AdminSDHolder process. Adversaries often modify this object to establish persistence and gain unauthorized access to highly privileged accounts within the domain.
Detects suspicious device registrations to Azure AD's Device Registration Service (DRS) using the device code flow. This rule identifies registrations where the device OS attributes are suspicious (e.g., version 0.0.0.0) or where a non-Windows OS claims a Windows identity, potentially indicating an adversary attempting to bypass conditional access policies or gain persistent access.
Page 15 of 40