Anomaly Detection Rules

Following out-of-the-box templates are bundled:

1. Login Activity at Unusual Time: Fires when a user logs in successfully from outside your network at a time outside their normal hour-of-day and day-of-week pattern.

2. Unix Data Upload Activity at Unusual Time: Fires when a Unix host runs an upload, file transfer, or cloud sync command at a time outside its normal activity window.

3. Unix Privilege Escalation Activity at Unusual Time: Fires when a Unix user runs privilege escalation commands, such as sudo, su, or usermod, at an unusual time.

4. Unix Scheduled Task or Timer Activity at Unusual Time: Fires when a Unix user creates, changes, or starts a cron job or systemd timer at an unusual time.

5. Unix Script or Shell Interpreter Execution at Unusual Time: Fires when a user runs a shell or scripting interpreter at a time outside their normal pattern.

6. High Risk PowerShell or CMD Execution at Unusual Time: Fires when a Windows user runs PowerShell or CMD with high-risk patterns, such as encoded commands or download cradles, at an unusual time.

7. Large Outbound Data Transfer at Unusual Time: Fires when an internal host sends a large transfer to an external destination at a time outside its normal pattern.

8. Rare Windows Binary Execution at Unusual Time: Fires when a Windows user runs a rarely seen binary, developer utility, or living-off-the-land tool at an unusual time.

9. High-Risk Windows LOLBAS and Script Interpreter Execution at Unusual Time: Fires when a Windows user runs a script interpreter or living-off-the-land binary with high-risk commands at an unusual time.

10. Windows Data Upload Activity at Unusual Time: Fires when a Windows user runs an upload or file transfer tool at a time outside their normal pattern.

11. Windows Privileged Activity at Unusual Time: Fires when a Windows user uses special privileges or changes a security group membership at an unusual time.

12. Windows Binary Execution for Privilege Escalation at Unusual Time: Fires when a Windows user runs a binary linked to UAC bypass or elevated execution, such as runas.exe or fodhelper.exe, at an unusual time.

13. Windows Scheduled Task Activity at Unusual Time: Fires when a Windows user creates or changes a scheduled task at a time outside their normal pattern.

14. Windows Script and LOLBAS Process Execution at Unusual Time: Fires when a Windows user runs a script interpreter, command shell, signed proxy binary, or admin tool at an unusual time.

15. Active Directory Account Management at Unusual Time: Fires when an administrator creates, enables, disables, deletes, resets, unlocks, or renames an Active Directory account at an unusual time.

16. Active Directory Object Change at Unusual Time: Fires when a user changes a Group Policy object or a security or distribution group at a time outside their normal pattern.

17. Windows Domain Logon at Unusual Time: Fires when a user logs on interactively to a Windows domain resource, including internal logons, at an unusual time.

Entity Attribute Rarity rules

1. Cloud Upload Detected: Fires when a user uploads files to a SharePoint or OneDrive destination they haven’t used before.

2. Cloud Upload Tool Execution: Fires when a user runs a cloud upload tool they haven’t used before.

3. LOLBAS Execution from Unusual Path: Fires when a living-off-the-land binary runs from a folder not previously seen for that user, or with suspicious command-line options.

4. Network Share Access: Fires when a user accesses a network share that’s rare or new for them, excluding administrative and domain replication shares.

5. New Device for User: Fires when a user logs in from a Windows workstation never previously associated with them.

6. New Login Location for User: Fires when a user logs in from a country never previously seen for them.

7. Rare LOLBAS Execution: Fires when a user runs a living-off-the-land tool, such as certutil or psexec, that they rarely or never use.

8. Rare Tool Usage: Fires when a user runs a monitored tool that’s rare or new for them, such as a network scanner, credential dumper, or remote access tool.

9. SharePoint or OneDrive Resource Access: Fires when a user accesses a SharePoint or OneDrive site that’s rare or new for them.

10. Protocol Usage Detection: Fires when an internal host uses a network protocol for outbound connections that’s rare or new for that host.

Entity Frequency Drift rules

1. Spike in Failed Login Attempts by a User: Fires when a user’s rate of failed logins rises above their own normal baseline.

2. Sudden Increase in Account Lockouts: Fires when the number of account lockouts on a host rises well above that host’s normal baseline.

3. High Number of Outbound Connections from a Host: Fires when an internal host opens far more outbound connections to external destinations than usual.

4. Spike in Process Launches on a Host: Fires when the rate of process creation on a host rises well above its normal baseline.

5. DNS Request Flood from a Host: Fires when an internal host sends far more DNS queries than its normal baseline.

6. Excessive VPN Sessions Within a Short Time: Fires when a user opens far more VPN sessions in a short time than their normal baseline.

7. Multiple Privilege Elevation Events by the Same User: Fires when a user generates far more privilege elevation events in a short time than their normal baseline.

8. Unusually High File Downloads by a User: Fires when a user downloads far more files in a short time than their normal baseline.

Statistical Measure rules

1. Unusual bytes per download: Fires when the amount of data a host downloads from an external destination falls outside that host’s normal range.

2. Unusual VPN Session Duration: Fires when a user’s VPN session lasts much longer or shorter than their normal baseline.

3. Unusual Outbound Transfer Size: Fires when the amount of data a host sends to an external destination falls outside that host’s normal range.

For more information on the shipped out-of-the-box templates and how to use it, see Work with out-of-the-box anomaly templates.