Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects activity when a member is added to a security-enabled global group
Detects activity when a member is removed from a security-enabled global group
Detects activity when a security-enabled global group is deleted
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Detects scenarios where one can control another users or computers account without having to use their credentials.
Addition of domains is seldom and should be verified for legitimacy.
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Detects when a user account is added to a high-privilege domain group (e.g., Domain Admins, Enterprise Admins, etc.)
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
The following analytic detects the rapid creation and deletion of Windows accounts within a short time frame of 1 hour. It leverages the "Change" data model in Splunk, specifically monitoring events with result IDs 4720 (account creation) and 4726 (account deletion). This behavior is significant as it may indicate an attacker attempting to create and remove accounts quickly to evade detection or gain unauthorized access. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further malicious actions within the environment. Immediate investigation of flagged events is crucial to mitigate potential damage.
Detects activity related to high-value (VIP) accounts, including:
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
Detects scenarios where an attacker manipulate a computer object and updates its attribute 'msDS-AllowedToActOnBehalfOfOtherIdentity' to enable a resource to impersonate and authenticate any domain user.
Page 29 of 40