Browse Rules

New AWS Account Created

A new AWS account was created

New User Account Created

A new account was created

Teleport Create User Accounts

A user has been manually created, modified, or deleted

Snowflake User Created

Detect new users created in snowflake

Slack Organization Created

Detects when a Slack organization is created

Snowflake User Created

Detect new users created in Snowflake.

Databricks User Account Created

Detects creation of new user accounts in Databricks. Account creation may be part of normal onboarding or could indicate an attacker establishing persistence.

Azure Automation Account Created

Detects when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. Adversaries may create Automation accounts to maintain persistence in their target's environment by leveraging managed identities and runbooks to execute code with elevated privileges.

GitHub User Access Key Created

Detects when a GitHub user access key is created.

Carbon Black API Key Created or Retrieved

Detects when a user creates a new API key or retrieves an existing key.

Azure Automation Account Created

Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment.

Snowflake User Enabled

Detect users being re-enabled in your environment

Snowflake User Enabled

Detects users being re-enabled in your environment.

New Kubernetes Service Account Created

Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.

User account created without expected attributes defined

'This query looks for accounts being created that do not have attributes populated that are commonly populated in the tenant. Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts. Created accounts should be investigated to ensure they were legitimated created. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user

A User Role with Sensitive Permissions has been Created

A Panther user role has been created that contains admin level permissions.

User Account Created Using Incorrect Naming Format

'This query looks for accounts being created where the name does not match a defined pattern. Attackers may attempt to add accounts as a means of establishing persistant access to an environment, looking for anomalies in created accounts may help identify illegitimately created accounts. Created accounts should be investigated to ensure they were legitimated created. The user_regex field in the query needs to be populated with the expected pattern for the environment before deployment. R

Account created from non-approved sources

'This query looks for an account being created from a domain that is not regularly seen in a tenant. Attackers may attempt to add accounts from these sources as a means of establishing persistant access to an environment. Created accounts should be investigated to confirm expected creation. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts'

New IAM Credentials Updated

A console password, access key, or user has been created.

AWS Network ACL Overly Permissive Entry Created

A Network ACL entry that allows access from anywhere was added.

Carbon Black User Added Outside Org

Detects when a user from a different organization is added to Carbon Black.

GCP Corporate Email Not Used

Unexpected domain is being used instead of a corporate email

Azure Kubernetes RoleBinding or ClusterRoleBinding Created

Detects when a RoleBinding or ClusterRoleBinding is created in Azure Kubernetes Service (AKS) or Arc-enabled Kubernetes clusters. Role bindings grant permissions to Kubernetes subjects (users, groups, or service accounts) by binding them to roles with specific permissions. Adversaries with appropriate access may create malicious role bindings to escalate privileges, assign cluster-admin roles, or maintain persistent access to the Kubernetes cluster. This detection applies to both AKS managed clu

IAM Entity Created Without CloudFormation

An IAM Entity (Group, Policy, Role, or User) was created manually. IAM entities should be created in code to ensure that permissions are tracked and managed correctly.

Linux User Account Creation

Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.