Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects deletion of MFA configurations to enable authentication bypass
Detects when a user account's 'UserAccountControl' attribute is modified to include the 'Not Delegated' flag (EventID 4738). This change can be an indicator of an attacker attempting to alter account behavior for persistence or to evade detection, or it could be a legitimate administrative action.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
This rule alerts when edge router settings change outside an approved maintenance window. Surprise config changes can redirect traffic or weaken security controls. Confirm change tickets and the engineer responsible. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects LDAP-based modification of authentication configurations for credential theft
Detects LDAP account modifications used to maintain persistent access
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects a high volume of group membership changes (additions or removals) by a single user within a one-hour window. Event IDs 4728 (A member was added to a security-enabled global group), 4729 (A member was removed from a security-enabled global group), and 4730 (A member was removed from a security-enabled universal group) are monitored. A count of 5 or more such events by the same user within an hour is flagged as suspicious, potentially indicating malicious account manipulation or privilege escalation attempts.
Detects the use of the `sysadminctl` utility with the `addUser` or `-addUser` command-line arguments, which can be used to create new user accounts on macOS systems. This activity could indicate an adversary attempting to establish persistences by creating new accounts.
Page 21 of 40