| elastic |
OpenSSL Password Hash Generation |
production |
2026-10-09 |
| elastic |
Linux User Added to Privileged Group |
production |
2026-10-09 |
| splunk |
Windows Create Local Administrator Account Via Net |
production |
2026-10-09 |
| splunk |
Short Lived Windows Accounts |
production |
2026-10-09 |
| splunk |
Detect New Local Admin account |
production |
2026-10-09 |
| splunk |
Windows ESX Admins Group Creation via Net |
production |
2026-10-09 |
| splunk |
Windows Create Local Account |
production |
2026-10-09 |
| splunk |
Linux Add User Account |
production |
2026-10-02 |
| splunk |
Linux Auditd Add User Account |
production |
2026-10-02 |
| elastic |
ESXi Local Account Created |
production |
2026-09-30 |
| elastic |
Linux User Account Creation |
production |
2026-09-22 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Linux Group Creation |
production |
2026-09-18 |
| elastic |
Shadow File Modification by Unusual Process |
production |
2026-09-18 |
| elastic |
User or Group Creation/Modification |
production |
2026-09-18 |
| elastic |
Suspicious Passwd File Event Action |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
User Account Creation |
production |
2026-09-18 |
| elastic |
Creation of a Hidden Local User Account |
production |
2026-09-18 |
| elastic |
FortiGate Super Admin Account Creation |
production |
2026-09-18 |
| elastic |
FortiGate SSO Login Followed by Administrator Account Creation |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Account Creation from Unusual Source |
production |
2026-09-18 |
| elastic |
Potential Linux Backdoor User Account Creation |
production |
2026-09-18 |
| sigma |
New User Account Creation Attempt Via ADSI in CommandLine |
experimental |
2026-08-13 |
| sigma |
New User Account Creation Attempt Via ADSI |
experimental |
2026-08-13 |
| splunk |
Windows Privileged Group Modification |
production |
2026-05-13 |
| splunk |
Cisco ASA - New Local User Account Created |
production |
2026-05-13 |
| splunk |
ESXi Account Modified |
production |
2026-05-13 |
| splunk |
Linux Auditd Add User Account Type |
production |
2026-05-13 |
| splunk |
Windows ESX Admins Group Creation Security Event |
production |
2026-05-13 |
| splunk |
Windows ESX Admins Group Creation via PowerShell |
production |
2026-05-13 |
| sigma |
FortiGate - New Administrator Account Created |
experimental |
2025-11-01 |
| sigma |
FortiGate - New Local User Created |
experimental |
2025-11-01 |
| sigma |
Creation of a Local Hidden User Account by Registry |
test |
2025-10-31 |
| sigma |
Privileged User Has Been Created |
test |
2025-01-21 |
| sigma |
Hidden Local User Creation |
test |
2024-01-16 |
| sigma |
DarkGate - User Created Via Net.EXE |
test |
2023-10-15 |
| sigma |
New User Created Via Net.EXE With Never Expire Option |
test |
2023-02-21 |
| sigma |
New User Created Via Net.EXE |
test |
2023-02-21 |
| sigma |
Creation Of A Local User Account |
test |
2023-02-18 |
| sigma |
Cisco Local Accounts |
test |
2023-01-04 |
| sigma |
PowerShell Create Local User |
test |
2022-12-25 |
| sigma |
Creation Of An User Account |
test |
2022-12-20 |
| sigma |
Serv-U Exploitation CVE-2021-35211 by DEV-0322 |
test |
2022-12-18 |
| sigma |
Suspicious Windows ANONYMOUS LOGON Local Account Created |
test |
2022-10-09 |
| sigma |
User Added to Remote Desktop Users Group |
test |
2022-09-09 |
| sigma |
Local User Creation |
test |
2021-01-17 |