Search and filter across all detection sources
70 rules
Windows: User account changed.
PAM: User changed password.
Windows: Group Account Changed
Windows: General account database changed.
Windows: Security enabled group created.
Windows: Security enabled group deleted.
Windows: Group Account Created
Windows: Group Account Deleted
Windows: Administrators Group Changed
Windows: Everyone Group Changed
Windows: Users Group Changed
Windows: Guests Group Changed
Windows: Replicators Group Changed
Windows: Computer account added/changed/deleted.
Windows: Group account added/changed/deleted.
Windows: User account enabled or created.
Windows: User account disabled or deleted.
Windows: Authenticated Users Group Changed
Windows: Domain Admins Group Changed
Windows: Domain Users Group Changed
Windows: Domain Guests Group Changed
Windows: Domain Computers Group Changed
Windows: Domain Controllers Group Changed
Windows: Cert Publishers Group Changed
Windows: Schema Admins Group Changed