Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,061 detections
Filters
Last updated
All Time
Detection languages
594
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,872
5,155
4,866
1,061
Platforms
576
267
228
221
116
Products / Services
499
220
129
118
86
MITRE Techniques
487
451
362
349
339
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.
'This query will look for events where guest user was invited but has not accepted/redeemed invite for unusually longer period.
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Query #1: Look for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
This analytic detects AWS console login events by users who have not previously logged into the AWS console. It uses AWS CloudTrail events and compares them against a baseline of known users. A new user logging into the AWS console could indicate the creation of new accounts or potential unauthorized access, which could lead to unauthorized access to AWS resources, data exfiltration, or further exploitation within the cloud environment.
Detects logons using NTLM to hosts that are potentially not part of the domain, specifically targeting Remote Desktop Protocol (RDP) connections. This could indicate an attempt to establish remote access to systems outside of the managed domain, potentially for lateral movement or persistence.
Looks for a new device registration in Entra ID preceded by medium or high-risk sign-in session for the same user within maximum 6h timeframe.
This rule detects user logins from multiple distinct states or countries within a one-hour window, leveraging GeoIP enrichment. It specifically looks for successful login events where a user logs in from at least two different states or at least one country, indicating potential 'impossible travel' or suspicious access patterns.
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
This rule detects suspicious Kerberos Ticket Granting Ticket (TGT) requests, specifically looking for events where a computer account (indicated by a '$' at the end of the `TargetUserName`) requests a TGT with a certificate thumbprint present. This behavior is often observed after an attacker has obtained a computer certificate, potentially through techniques like PetitPotam, and is attempting to leverage it to request Kerberos tickets using tools like Rubeus. The rule focuses on Windows Event ID 4768, which signifies a Kerberos authentication service ticket request. It filters out requests from the local host (::1) and those without a certificate thumbprint.
Detects instances where an FTP service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to access or interact with the honeypot's services, which could be part of reconnaissance, initial access, or lateral movement activities.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Detects uncommon outbound network activity via Kerberos default port (88) indicating possible lateral movement or initial privilege escalation through delegation. The rule specifically filters out common legitimate processes like LSASS, Chrome, Firefox, and Tomcat that might generate similar network activity, aiming to reduce false positives.
This analytic identifies Azure Device Code Phishing attacks by detecting suspicious authentication requests using the device code authentication protocol within Azure AD SignInLogs. Such activity is significant as it indicates potential bypassing of Multi-Factor Authentication (MFA) and Conditional Access Policies (CAPs) through phishing. If malicious, attackers could gain unauthorized access to Azure AD, Exchange mailboxes, and Outlook Web Application (OWA), leading to potential data breaches and unauthorized data access.
This analytic detects when a suspicious certificate with a Subject Alternative Name (SAN) is issued using Active Directory Certificate Services (AD CS) and then immediately used for authentication. This detection leverages Windows Security Event Logs, specifically EventCode 4887 for certificate issuance and EventCode 4768 for Kerberos authentication. This activity is significant because improperly configured certificate templates can be exploited for privilege escalation and environment compromise. If confirmed malicious, an attacker could gain unauthorized access, escalate privileges, and potentially compromise the entire environment.
This detection monitors changes to critical Active Directory attributes: "msDS-AllowedToDelegateTo", "msDS-AllowedToActOnBehalfOfOtherIdentity", "scriptPath", and "msTSInitialProgram". Modifications to these attributes can indicate potential malicious activity, such as privilege escalation, persistence, or lateral movement attempts. The rule also notes that "msDS-KeyCredentialLink" is another important attribute for monitoring, though it may require tuning. Immediate investigation is recommended upon alert.
The following analytic identifies when a new device is enrolled on an Okta account. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to detect the creation of new device enrollments. This activity is significant as it may indicate a legitimate user settinging up a new device or an adversary adding a device to maintain unauthorized access. If confirmed malicious, this could lead to potential account takeover, unauthorized access, and persistent control over the compromised Okta account. Monitoring this behavior is crucial for detecting and mitigating unauthorized access attempts.
This correlation rule identifies when a user exceeds a predefined risk threshold based on multiple suspicious Okta activities within a 24-hour period. It aggregates risk events from "Suspicious Okta Activity," "Okta Account Takeover," and "Okta MFA Exhaustion" analytic stories. The detection is significant as it highlights potentially compromised user accounts exhibiting multiple tactics, techniques, and procedures (TTPs). If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment.
The analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an Azure AD account. It leverages Azure AD AuditLogs to identify when a user registers new security information. This activity is significant because adversaries who gain unauthorized access to an account may add their own MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security controls, maintain long-term access, and potentially escalate their privileges within the environment.
The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks.
Page 46 of 51