Browse Rules

Search and filter across all detection sources

54 rules

sagan informational other

[BOMGAR] Beyond Trust account_group_changed

[BOMGAR] Beyond Trust account_group_changed

sentinel informational kql

Objects for Protection Group Changed

Detects when protection group objects are updated.

wazuh high xml

Windows: Administrators Group Changed

Windows: Administrators Group Changed

wazuh low xml

Windows: Everyone Group Changed

Windows: Everyone Group Changed

wazuh low xml

Windows: Users Group Changed

Windows: Users Group Changed

wazuh high xml

Windows: Guests Group Changed

Windows: Guests Group Changed

wazuh medium xml

Windows: Replicators Group Changed

Windows: Replicators Group Changed

wazuh low xml

Windows: Authenticated Users Group Changed

Windows: Authenticated Users Group Changed

wazuh high xml

Windows: Domain Admins Group Changed

Windows: Domain Admins Group Changed

wazuh low xml

Windows: Domain Users Group Changed

Windows: Domain Users Group Changed

wazuh high xml

Windows: Domain Guests Group Changed

Windows: Domain Guests Group Changed

wazuh low xml

Windows: Domain Computers Group Changed

Windows: Domain Computers Group Changed

wazuh high xml

Windows: Domain Controllers Group Changed

Windows: Domain Controllers Group Changed

wazuh medium xml

Windows: Cert Publishers Group Changed

Windows: Cert Publishers Group Changed

wazuh high xml

Windows: Schema Admins Group Changed

Windows: Schema Admins Group Changed

wazuh high xml

Windows: Enterprise Admins Group Changed

Windows: Enterprise Admins Group Changed

wazuh medium xml

Windows: Power Users Group Changed

Windows: Power Users Group Changed

wazuh medium xml

Windows: Account Operators Group Changed

Windows: Account Operators Group Changed

wazuh medium xml

Windows: Server Operators Group Changed

Windows: Server Operators Group Changed

wazuh medium xml

Windows: Print Operators Group Changed

Windows: Print Operators Group Changed

wazuh high xml

Windows: Backup Operators Group Changed

Windows: Backup Operators Group Changed

wazuh medium xml

Windows Authorization Access Group Changed

Windows Authorization Access Group Changed

wazuh high xml

Windows: Cryptographic Operators Group Changed

Windows: Cryptographic Operators Group Changed

wazuh low xml

Windows: Security Enabled Local Group Changed

Windows: Security Enabled Local Group Changed

wazuh low xml

Windows: Security Enabled Global Group Changed

Windows: Security Enabled Global Group Changed