Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer) on Windows endpoints within a 4-hour window of associated cloud identity risk activity (such as risky sign-ins, MFA changes, or privilege grants). It filters out legitimate activity initiated via standard software management pipelines (e.g., SCCM, Intune) to identify potential unauthorized use of remote access software by adversaries following account compromise.
The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.
This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object.
This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.
This detection identifies when users are added to privileged Active Directory
groups by leveraging the Windows Security Event Code 4728 along with a lookup
of privileged AD groups provided by Splunk Enterprise Security.
Attackers often add user accounts to privileged AD groups to escalate privileges
or maintain persistence within an Active Directory environment.
Monitoring for modifications to privileged groups can help identify potential security breaches
and unauthorized access attempts.
groups by leveraging the Windows Security Event Code 4728 along with a lookup
of privileged AD groups provided by Splunk Enterprise Security.
Attackers often add user accounts to privileged AD groups to escalate privileges
or maintain persistence within an Active Directory environment.
Monitoring for modifications to privileged groups can help identify potential security breaches
and unauthorized access attempts.
Detect when a user creates a new DACL in AD for their own AD object.
Detects modifications to Microsoft Entra ID (formerly Azure AD) applications, service principals, or Application Proxy configurations that could be indicative of an adversary establishing persistent external access. This includes updates to external URLs, SSO settings, and authentication types, which are frequently used to facilitate persistence via malicious cloud application configurations.
Detects when a user is added as an owner to an Azure AD Application or Service Principal, specifically highlighting instances where the new owner does not currently hold a privileged directory role. This pattern is often used as a persistence mechanism to maintain long-term access to an environment without requiring high-level administrative credentials.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
This rule detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer) on Windows endpoints within a 4-hour window of associated cloud identity risk activity (such as risky sign-ins, MFA changes, or privilege grants). It filters out legitimate activity initiated via standard software management pipelines (e.g., SCCM, Intune) to identify potential unauthorized use of remote access software by adversaries following account compromise.
Detects the assignment of high-privilege Entra ID directory roles (e.g., Global Administrator) to identities that either have a recent risky sign-in history or were created within the last 48 hours. This pattern is indicative of privilege escalation following account compromise or the creation of backdoored accounts by an attacker. Assignments including change management tracking tags are excluded to reduce noise.
Detects cloud service principals identified as AI agents or assistants performing sensitive API operations such as IAM policy modifications or storage configuration changes. This pattern may indicate that an AI service account has been compromised or misused to perform reconnaissance, privilege escalation, or persistence, exceeding its intended scope of operation.
Detects the modification of critical Entra ID authentication method policies, such as the registration or configuration of external MFA/OIDC providers, by a user account shortly after an anomalous or high-risk login event. This behavior is indicative of an attacker attempting to establish persistent backdoor access via rogue MFA provider registration, consistent with techniques used to subvert cloud authentication policies.
This rule monitors network device audit logs for suspicious activities that indicate potential persistence or defense evasion on edge/VPN/router appliances. It specifically flags configuration changes, creation of new administrative accounts, addition of unauthorized SSH keys, and the disabling of logging/syslog export, which are common tactics for maintainig unauthorized access on network infrastructure.
Detects a suspicious pattern consistent with rapid handoff from an initial access broker to an operator: a user account is added to a privileged group (e.g., Domain Admins) followed within 5 minutes by successful logins to 3 or more distinct hosts. This behavior indicates immediate privilege escalation followed by rapid lateral movement.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects high-privilege user accounts (e.g., executives, administrators) undergoing a credential or MFA reset, followed by an atypical sign-in event within a two-hour window. This pattern is indicative of potential account takeover or identity-compromise scenarios, often associated with help-desk vishing attacks where an attacker induces a user or administrator to reset credentials or MFA methods.
Detects unauthorized or suspicious configuration changes on Cisco IOS XR devices, specifically targeting the creation of SPAN/mirroring sessions, ACL modifications to bypass traffic filtering, and changes to AAA or local user authentication settings. These patterns are consistent with post-compromise activities by adversaries seeking persistence and traffic interception.
Detects tenant-level enablement of Microsoft Teams external/federated access or addition of an unfamiliar external domain shortly before a spike in inbound Teams calls to helpdesk/IT-support-tagged users — models CrowdStrike's 2026 Financial Services Threat Landscape Report on 'Mutant Spider,' the most active threat to financial services, whose primary technique is voice phishing over Microsoft Teams impersonating internal IT.
Detects when a service principal is added as an owner to an application or another service principal. This activity indicates a potential privilege escalation or persistence attempt, where a compromised application gains administrative control over other identities or resources within the Azure environment.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Page 4 of 40