Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule detects the use of PowerShell cmdlets from the 'Microsoft.PowerShell.LocalAccounts' module, which are used to manipulate local user accounts. This includes actions such as disabling, enabling, getting information about, setting properties of, creating, renaming, and removing local users. Adversaries may manipulate accounts to maintain access to victim systems, modify credentials, or change permission groups.
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Detects attempts to change the password of the Directory Services Restore Mode (DSRM) administrator account. This account is a local administrator account on Domain Controllers, and attackers may modify its password to establish persistence or elevate privileges.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
Detects when a security-enabled global group is deleted in a Windows environment. This activity can be indicative of an adversary attempting to remove traces of their presence or disrupt normal operations by deleting critical groups.
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
This rule detects when a user is added to the local Administrators group on a Windows system. It specifically looks for command-line executions of 'net.exe' with 'localgroup <groupname> /add' or 'powershell.exe' with 'Add-LocalGroupMember -Group <groupname>', where the group name contains 'administrators' or 'administrateur'. This activity is often associated with privilege escalation or persistence techniques by adversaries.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. This action can be used by adversaries to maintain persistence on a compromised account by preventing its password from expiring, thus avoiding the need to frequently update credentials.
This analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Detect when a user creates a new Discretionary Access Control List (DACL) in Active Directory for their own AD object. This can be an indicator of an adversary attempting to maintain persistence or escalate privileges by modifying permissions on their own account to grant themselves additional rights or to prevent other users from modifying their account.
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
This KQL query detects the activation or modification of Guest accounts or Guest group memberships, which may indicate unauthorized access attempts or privilege escalation.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Analysts should review the initiating user (SubjectUserName) and process context. Confirm whether the Guest account is expected to be active on the system. Investigate the host for signs of lateral movement or privilege abuse. Correlate with logon events and group membership changes. Escalate if Guest account activation is unexpected or unauthorized.
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Page 28 of 40