Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,413
detections

Search detections

Filters

Showing 30 of 11,413

Windows Renamed Python Binary was Executed

The following analytic identifies a Python process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.

T1036.003T1059.006

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 7, 2026

InformationalSplunk security content

Windows Renamed Popular 3rd Party Software was Executed

The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.

T1036.003

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 7, 2026

InformationalSplunk security content

Windows Renamed LOLBAS Binary was Executed

The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.

T1036.003

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 7, 2026

InformationalSplunk security content

Windows Renamed Command Interpreter was Executed

The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.

T1036.003T1059

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 7, 2026

MediumSplunk security content

Windows AD SPN Unicode Collision Injection

The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner).

T1562.010

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 7, 2026

MediumSplunk security content

Azure AD User Consent Blocked for Risky Application

The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization.

T1528

Written by: Mauricio VelazcoAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Secret access fan-out by user

Ranks users by the number of distinct secrets they accessed or exported over the lookback window, with no alerting threshold applied. The 'Bulk secret export / access' analytic rule only fires above a tuned distinct-secret threshold; this hunting query shows the full distribution so an analyst can establish what normal access fan-out looks like per principal and spot users trending upward before they cross the alert line.

T1212T1555

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Secret access audit trail

Chronological, per-event audit trail of every Delinea Secret Server secret operation over the lookback window - views, exports, downloads, retrievals, copies, edits and deletes - with no alerting threshold applied. Each row records who performed the action, which secret, the derived action verb, the source IP, and the original message.

T1212T1555

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Rare / first-seen event types

Identifies Delinea Platform event types that appear in the recent window but were never seen during the preceding baseline period, using a leftanti join against the baseline set - with no alerting threshold applied. A brand-new event type can signal a newly enabled feature, a configuration change, or an attacker exercising functionality the environment does not normally use. Pivot on the users and source IPs associated with each first-seen event type to decide whether it is benign.

T1087T1518

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Off-hours privileged activity

Surfaces privileged-activity events (Level == "PrivilegedActivity") that occur outside normal business hours - before 'bizStartHourUtc', after 'bizEndHourUtc', or on a weekend - over the lookback window, with no alerting threshold applied. Privileged operations such as secret access or configuration changes performed at unusual times can indicate a compromised account, an attacker operating in a different time zone, or insider activity outside oversight.

T1212T1555

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Failed operations

Surfaces every failed, denied, or errored operation across all Delinea Platform services over the lookback window, with no alerting threshold applied. Failures are identified from failed MFA / password factors, any login fail reason, or an event name / message containing failed / error / denied / unauthorized. Unlike the 'Failed authentication spike' rule (auth only, above a tuned threshold) this hunting query is service-wide and shows everything, so an analyst can spot scattered

T1110

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Events by severity

Breaks down the Delinea Platform audit stream by event severity / level (e.g. PrivilegedActivity, Info, Warning, Error) over the lookback window, with no alerting threshold applied. Shows the event count, distinct users, and the top event types contributing to each level so an analyst can gauge the overall mix of activity and zero in on the higher-severity tiers. Use it to spot an unusual spike of privileged or error-level events relative to normal volume.

T1087

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Configuration changes

Threshold-free audit trail of state-changing modifications to Delinea platform configuration over the lookback window - authentication profiles, security / access policies, SSO or identity-provider (SAML / OIDC / federation) settings, IP range / restriction rules, integration / webhook / connector settings, and role / permission changes. Read-only "viewed" events are excluded so only add / update / delete / enable / disable actions remain.

T1098T1484T1556

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Authentication failures ranked by account

Surfaces every account with failed authentication activity over the lookback window, ranked by failure count and distinct source IPs - with no alerting threshold applied. The 'Failed authentication spike' analytic rule only fires above a tuned threshold (e.g. 10 in 15m); this hunting query deliberately shows everything below that line so an analyst can spot low-and-slow brute-force or credential-stuffing that stays under the radar.

T1110

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - All events by user

Summarizes every Delinea Platform audit event over the lookback window grouped by the acting user, with no alerting threshold applied. Gives an analyst a single per-principal activity baseline - total events, which services and event types each user touched, how many distinct source IPs they came from, and their first/last activity in range. Pivot on users with an unusually broad event-type or source-IP footprint, or use it as the starting point for a deeper per-user investigation.

T1087

Licence: MIT License
Published: Oct 7, 2026

UnknownMicrosoft Sentinel analytics

Delinea - Activity by source IP

Summarizes Delinea Platform activity grouped by source IP address over the lookback window, with no alerting threshold applied. For each IP it reports the event count, how many distinct users and services it touched, the event-type footprint, and first/last seen. A single IP associated with many distinct accounts can indicate password spraying, a shared NAT / VPN egress, or a compromised host proxying activity; pivot on IPs with an unexpectedly high distinct-user count or originating from

T1078T1087

Licence: MIT License
Published: Oct 7, 2026

HighMicrosoft Sentinel analytics

Delinea - Sensitive secret accessed by new user (first access in 14 days)

Detects when a user accesses a high-value secret for the first time, with no access to that same secret by that user in the prior 14 days. First-time access to a sensitive secret can indicate lateral movement or credential targeting. Delinea reports no in-band sensitivity flag, so a secret is treated as high-value when its name or its folder matches 'sensitivePattern' (common privileged naming conventions), or when it appears in 'customSecretNames' / 'customFolders'.

T1078T1555

Licence: MIT License
Published: Oct 7, 2026

MediumMicrosoft Sentinel analytics

Delinea - Privileged account access anomaly (secret-access volume vs baseline)

Detects when a user's secret-access volume for the current day significantly exceeds their own recent baseline (per-user daily average plus a standard-deviation factor over the prior ~14 days). A sudden spike relative to a principal's normal behaviour can indicate a compromised privileged account or insider misuse. Tune 'factor' and 'minDaily' to balance noise against coverage.

T1212T1555

Licence: MIT License
Published: Oct 7, 2026

HighMicrosoft Sentinel analytics

Delinea - Privilege escalation detected (role / permission changes)

Detects role assignments, permission or right grants, admin grants and elevation events that the acting user has not performed against the same target in the prior 14 days. Only grant-type actions (added / assigned / granted / elevated / approved / created / updated) against role, permission, privilege, admin or entitlement objects are considered; removals and read-only events are excluded, and plain group-membership or ownership events are not matched because they make up most routine

T1078T1098

Licence: MIT License
Published: Oct 7, 2026

MediumMicrosoft Sentinel analytics

Delinea - Platform configuration change

Detects state-changing modifications (add / update / delete / enable / disable) to critical Delinea platform settings - authentication profiles and policies, SSO or identity-provider (SAML / OIDC / OAuth / federation) configuration, IP range / restriction rules and webhooks - that the acting user has not performed in the prior 14 days.

T1098T1484T1556

Licence: MIT License
Published: Oct 7, 2026

MediumMicrosoft Sentinel analytics

Delinea - Bulk secret export / access

Detects a single user accessing or exporting an unusually large number of distinct secrets in Delinea Secret Server within a short window. In addition to secret views, this rule also matches export / download / retrieve operations, which are a stronger signal of vault scraping prior to exfiltration ("secret hoarding"). Tune 'threshold' to your environment's normal access patterns.

T1212T1555

Licence: MIT License
Published: Oct 7, 2026

MediumMicrosoft Sentinel analytics

Delinea - Failed authentication spike (single account)

Detects when a single account accumulates an unusually high number of failed authentication events within a short window. Only authentication events - MFA, login and sign-in - are considered; the service-wide view of every failure lives in the 'Delinea - Failed operations' hunting query. A failure is a failed MFA result, a failed password factor, or any login fail reason. A burst of failures for one account can indicate brute-force or credential-stuffing activity.

T1110

Licence: MIT License
Published: Oct 7, 2026

MediumElastic detection rules

Incoming Execution via PowerShell Remoting

Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.

T1021T1021.006T1059T1059.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

SMB Connections via LOLBin or Untrusted Process

Identifies potentially suspicious processes that are not trusted or living-off-the-land binaries (LOLBin) making Server Message Block (SMB) network connections over port 445. Windows File Sharing is typically implemented over SMB, which communicates between hosts using port 445. Legitimate connections are generally established by the kernel (PID 4).

T1021T1021.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Potential Uninstall Entry Concealment

Identifies execution of the Hide From Uninstall List utility or a registry change that marks an installed application as a system component, causing Windows to omit it from Programs and Features. Adversaries may use either method to conceal remote-access, security, or other software.

T1112T1564

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Access to a Sensitive LDAP Attribute

Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as ms-PKI-DPAPIMasterKeys, ms-PKI-AccountCredentials, and msPKI-CredentialRoamingTokens.

T1003T1078T1078.002T1213T1552+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Potential Credential Access via DCSync

This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.

T1003T1003.006T1078T1078.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Multiple Logon Failure from the same Source Address

Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.

T1110T1110.001T1110.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Privileged Accounts Brute Force

Identifies multiple consecutive logon failures targeting more than one Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.

T1110T1110.001T1110.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 7, 2026

MediumElastic detection rules

Potential Data Exfiltration Through Curl

Detects the use of curl to upload files to an internet server. Threat actors often will collect and exfiltrate data on a system to their C2 server for review. Many threat actors have been observed using curl to upload the collected data. Use of curl in this way, while not inherently malicious, should be considered highly abnormal and suspicious activity.

T1048T1048.001T1048.003