AN0265
Analytic 0265
Windows
Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.
WinEventLog:Security
EventCode=4738, 4728, 4670
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Time between suspicious process and account change (e.g., 5m).
[HighPrivilegeGroupList]
Customize group list (e.g., Domain Admins, Enterprise Admins) to monitor.
[SubjectTargetMismatch]
Flag if account modifier != modified user (potential hijack).
AN0266
Analytic 0266
Linux
Use of native tools or scripting (e.g., `usermod`, `passwd`, `groupmod`) to escalate permissions or persist access on existing users, correlated with login or process events.
auditd:SYSCALL
usermod, groupmod, passwd
auditd:PATH
/etc/passwd or /etc/group file write
[SudoPath]
Common sudo or privilege escalation paths (e.g., `/usr/bin/passwd`).
[ModifiedShellList]
Detect if user shell is changed to unusual one (e.g., /bin/sh -> /bin/bash).
AN0267
Analytic 0267
macOS
Modifications to user accounts via `dscl`, `pwpolicy`, or System Preferences CLI (`sysadminctl`) that alter user groups, enable root, or bypass MDM restrictions.
macos:unifiedlog
com.apple.accountsd, com.apple.opendirectoryd
[ModifiedUserList]
Track known non-system user UIDs or service accounts.
[GroupMembershipChanges]
List of sensitive groups (admin, _developer, _analyticsd).
AN0268
Analytic 0268
Identity Provider
Modifications to SSO/SAML user attributes (e.g., `isAdmin`, `role`, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.
saas:okta
User Attribute Modified / Role Assignment Changed
[RoleAssignmentBaseline]
Expected user-role pairings per app or org unit.
[APIUsageContext]
Caller identity or IP address ranges for identity admin actions.
AN0269
Analytic 0269
ESXi
Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.
esxi:vpxa
vim.SessionManager.login / vim.AccountManager.createUser
[VMAdminAccountName]
Expected account name patterns for ESXi/vCenter admins.
[NetworkAccessLocation]
Expected IPs/subnets for legitimate ESXi access.
AN0270
Analytic 0270
SaaS
Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.
m365:unified
Admin Activity > Role Change or Sharing Change
[SharingSensitivityLabel]
Threshold for labeling sensitive document access escalation.
[CrossOrgChanges]
Track changes made across organizational boundaries (e.g., guest users).