Valid Accounts detection rulesT1078

Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

windows

Detects when an account was created and deleted in a short period of time.

azure

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

azure

Detects when a configuration change is made to an applications AppID URI.

azure

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

azure

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

azure

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

aws

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".

aws

Detects S3 Browser utility creating IAM User or AccessKey.

aws

Indicates user activity that is unusual for the user or consistent with known attack patterns.

azure

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

m365

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure

Detects when changes are made to PIM roles

azure

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

windows

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

azure

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

azure

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

aws

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

azure

Detects when Okta identifies new activity in the Admin Console.

okta

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

opencanary · application

Detects when PIM alerts are set to disabled.

azure

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

azure

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

azure

Detects failed sign-in due to user not meeting expected controls for adminitrators

azure

Identifies when the same privilege role has multiple activations by the same user.

azure

Identifies when a privilege role can be activated without performing mfa.

azure

Identifies when a user has been assigned a privilege role and are not using that role.

azure

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

azure

Define a baseline threshold for failed sign-ins due to Conditional Access failures

azure

Monitor and alert for sign-ins where the device was non-compliant.

azure

Identifies when an account hasn't signed in during the past n number of days.

azure

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

azure

Detects risky authentication from a non AD registered device without MFA being required.

azure

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

azure

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

azure

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

azure

Alert on when legacy authentication has been used on an account

azure

Detects when a user is added to a privileged role.

azure

Monitor and alert for users added to device admin roles.

azure

Detects accounts that are created or deleted by non-approved users.

azure

Detects when an account is disabled or blocked for sign in but tried to log in

azure

This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

windows

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

azure

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

azure

Detect when authentications to important application(s) only required single-factor authentication

azure

Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.

aws

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

aws

Detects AWS root account usage

aws

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

aws

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

aws

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

aws

Identifies when an user or application modified the federation settings on the domain.

azure

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

azure

Detects when there is a interruption in the authentication process.

azure

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

bitbucket

Monitor and alert for Bitlocker key retrieval.

azure

Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

windows · process_creation

Monitor and alert for device registration or join events where MFA was not performed.

azure

Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows · ps_script

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

windows

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

windows

Detects when changes are made to the SSH certificate configuration of the organization.

github

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

gcp

Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor

gcp

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

azure

Detects guest users being invited to tenant by non-approved inviters

azure

Detects interactive console logons to Server Systems

windows

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

kubernetes

Detect failed attempts to sign in to disabled accounts.

azure

Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.

m365

Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.

m365

Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability. The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups. Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse. If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

azure

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

azure

Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.

windows · process_creation

Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025. The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups. Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment. It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows. So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.

windows

Detects a when net.exe is called with a password in the command line

windows · process_creation

Detect when a user has reset their password in Azure AD

azure

Detects when a new admin is created.

azure

Detects attempts to enable the root account via "dsenableroot"

macos · process_creation

Detect successful authentications from countries you do not operate out of.

azure

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

windows · ps_module

Detects Google Workspace login activity that's classified as suspicious by Google.

gcp

Detects suspicious processes logging on with explicit credentials

windows

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

azure

Detects attempts to create and add an account to the admin group via "dscl"

macos · process_creation

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

macos · process_creation

Detects attempts to create and add an account to the admin group via "sysadminctl"

macos · process_creation

User Added to an Administrator's Azure AD Role

azure

Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

windows

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

azure

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

azure

Detect remote login by Administrator user (depending on internal pattern).

windows

Detect when users are authenticating without MFA being required.

azure

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

cisco

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

cisco

Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.

windows · ps_script

Detect failed authentications from countries you do not operate out of.

azure

Detects when a user creates action secret for the organization, environment, codespaces or repository.

github

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

github

Detects attempts to enable the guest account using the sysadminctl utility

macos · process_creation

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

huawei

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

juniper

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

azure