Browse Rules

Snowflake Account Admin Granted

Detect when account admin is granted.

Snowflake Account Admin Granted

Detect when account admin is granted.

Admin Role Assigned

Assigning an admin role manually could be a sign of privilege escalation

Snowflake Grant to Public Role

Detect additional grants to the public role.

[CROWDSTRIKE] Possible Privilege Escalation Detected - User Executed Valid Accounts DCE/RPC Command Targeting DC For First Time

[CROWDSTRIKE] Possible Privilege Escalation Detected - User Executed Valid Accounts DCE/RPC Command Targeting DC For First Time

AWS Root Account Hardware MFA

This policy validates that a hardware MFA device is in use for access to the root account.

Root Console Login

The root account has been logged into.

Okta Admin Role Assigned

A user has been granted administrative privileges in Okta

AWS IAM Policy Administrative Privileges

This policy validates that there are no IAM policies that grant full administrative privileges to IAM users or groups.

Zendesk Account Owner Changed

Only one admin user can be the account owner. Ensure the change in ownership is expected.

GCP IAM Role Has Changed

A custom role has been created, deleted, or updated.

AWS IAM Policy Does Not Grant Network Admin Access

This policy validates that no IAM policies grant admin privileges on network resources. This should be used in conjunction with suppressions for the legitimate network admin policies in your account.

AWS Root Account MFA

Validates that Multi-Factor Authentication (MFA) is enabled for the AWS root account. The root account has complete unrestricted access to all AWS resources and is the highest-value target for attackers. Without MFA, accounts are vulnerable to phishing, credential stuffing, and password compromise attacks.

AWS IAM Role Restricts Usage

This policy validates that IAM roles in the account are restrictive in what entities may assume them. This can help prevent malicious actors from assuming roles they should not be assuming.

AWS IMDS Credential Usage Outside Expected Services

Detects when an EC2 instance identity (credentials obtained via IMDS) is used to make API calls outside of expected internal AWS services like SSM. This indicates that IMDS credentials may have been exfiltrated from a compromised instance and are being used externally for lateral movement or privilege escalation.

Root Account Activity

Root account activity that modifies AWS resources or configuration was detected. Read-only root events (enumeration, console reads) are excluded — only impactful root actions trigger this rule.

AWS IAM Policy Assigned to User

This policy validates that there are no IAM policies assigned directly to users. Best practice suggests assigning to an IAM group and placing users within that group.

AWS IAM Group Users

This Policy ensures that all IAM groups have at least one IAM user. If they are vacant, they should be deleted.

AWS IAM Policy Does Not Grant Any Administrative Access

This policy validates that no IAM policies grant admin access. This should be combined with suppressions on the legitimate IAM admin policies in your account so that it only fires when new and unexpected policies granting admin access are created.

AWS IAM Policy Blocklist

This detects the usage of highly permissive IAM Policies that should only be assigned to a small number of users, roles, or groups.

Azure Kubernetes RoleBinding or ClusterRoleBinding Created

Detects when a RoleBinding or ClusterRoleBinding is created in Azure Kubernetes Service (AKS) or Arc-enabled Kubernetes clusters. Role bindings grant permissions to Kubernetes subjects (users, groups, or service accounts) by binding them to roles with specific permissions. Adversaries with appropriate access may create malicious role bindings to escalate privileges, assign cluster-admin roles, or maintain persistent access to the Kubernetes cluster. This detection applies to both AKS managed clu

AWS IAM User Not In Conflicting Groups

This policy validates that IAM users are not in IAM groups that are considered mutually exclusive. For example, in some workflows developers are responsible for dev environments and sysadmins are responsible for prod environments. In this situation no (or very few) users should be in both sysadmin and developer groups. This is in following with the principle of least privilege.

Password Validation Check via DSCL from Uncommon Process - macOS [splunk-edr]

Threat actors targeting macOS systems, such as those using Atomic Stealer, may abuse the dscl command with the authonly option to silently test for valid local credentials. This technique enables actors to verify password correctness without logging in, aiding credential validation, privilege escalation, or account enumeration. This use case detects instances where dscl authonly is executed from shell or AppleScript-based processes, indicating potential misuse of macOS directory services for cre

Remote Computer Account DnsHostName Update

Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.

Google Workspace User Organizational Unit Changed

Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to.