Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
266 detections
Filters
Last updated
All Time
Detection languages
107
84
28
14
12
Contributors
69
38
34
21
19
Categories
182
134
87
62
38
Platforms
174
50
25
16
14
Products / Services
95
43
28
18
17
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
8
6
6
5
5
IDS Classtypes
2
1
IDS Protocols
1
1
Detects the creation of suspicious local accounts that mimic the 'ANONYMOUS LOGON' account, potentially using additional spaces or other obfuscation techniques. This rule specifically targets Event ID 4720 (A security-enabled local group was created) and looks for 'ANONYMOUS' and 'LOGON' within the SamAccountName field, aiming to cover scenarios where such accounts are created to bypass detection or for malicious persistence.
Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.
Detects the creation of a new user profile in the Windows Registry with specific usernames ('ANONYMOUS' or '_DomainUser_') within the ProfileList, which has been observed in some variants of the COLDSTEEL RAT malware. This indicates potential persistence or privilege escalation attempts by creating a new user account.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
Detects the creation of a local user account using the 'New-LocalUser' PowerShell cmdlet. This rule specifically looks for the 'New-LocalUser' string within PowerShell script block logs, indicating an attempt to create a new local user on a Windows system.
Detects the creation of new local user accounts using the 'net.exe' or 'net1.exe' command-line utility with the 'user add' arguments. This activity can be indicative of an adversary establishing persistence or creating accounts for lateral movement.
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
Local User Creation
Sigma
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Detects creation of local users via the net.exe command with the option "never expire"
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Detects creation of a local user via PowerShell
Identifies the creation of local users via the net.exe command.
Page 13 of 13