Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
780 detections
Filters
Last updated
All Time
Detection languages
429
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,872
5,155
4,866
780
Platforms
339
222
141
139
71
Products / Services
318
166
85
57
49
MITRE Techniques
413
348
254
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.
This rule detects potential password spraying activity by monitoring for a single source IP address that targets multiple distinct user accounts with failed authentication attempts. It specifically identifies 'low-and-slow' patterns that may attempt to evade standard lockout thresholds, and flags cases where legacy authentication protocols are utilized, a technique commonly employed to bypass Multi-Factor Authentication (MFA).
This rule monitors Linux system authentication logs to identify potential unauthorized access attempts. It triggers when a single source IP initiates a high volume of failed SSH login attempts (brute force) or when a single user account is targeted by multiple distinct source IPs within a short time window (password spraying).
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects anomalous authentication patterns where a single source IP targets a high number of unique user accounts with failed authentication attempts over a rolling window. By filtering out SSO/Federated methods and specific service account patterns, this rule isolates low-and-slow brute-force or password-spraying activities designed to evade standard account lockout mechanisms.
Detects anomalous AWS activity combining bulk secret retrieval from AWS Secrets Manager using the BatchGetSecretValue API with subsequent authentication failures or validation errors in AWS STS. This behavior is indicative of automated credential harvesting pipelines or agentic frameworks rapidly enumerating and testing stolen credentials.
This rule detects a password-spraying attack pattern directed at privileged or manager-titled accounts. It monitors for multiple failed sign-in attempts from a single source IP address against a large volume of distinct user accounts identified as managers or senior staff. The detection logic filters for low-frequency attempts per account, which is indicative of a distributed spray attack designed to evade account lockout thresholds while focusing on high-value targets.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
This rule detects potential brute-force activity against remote access services (OpenVPN, StrongSwan, WireGuard, and SSH) on Linux hosts by monitoring Syslog for patterns indicating repeated failed authentication attempts. It further highlights instances where a burst of failed attempts is followed by a successful authentication for the same source IP, indicating a potential successful compromise.
Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
Detects potential MFA push fatigue (bombing) attacks by identifying users who receive an abnormal frequency of MFA push notification denials or interruptions within a short window, followed immediately by a successful authentication on a previously unseen device fingerprint. This pattern is characteristic of attackers attempting to wear down users into approving unauthorized login requests.
This rule detects a potential brute force attack against the Microsoft SQL Server 'sa' administrative account. It identifies a high volume of failed authentication events (Event ID 18456) for the 'sa' account within a 10-minute window, followed by a successful authentication event (Event ID 18453 or 18454) from the same source IP address. The rule specifically filters for successful logins originating from non-private (internet-facing) IP addresses, suggesting an attempt from an external threat actor.
This rule identifies potential brute force or password spraying attacks against network edge devices, such as firewalls and VPN gateways. It aggregates authentication failures and denied connection attempts by source IP address. The rule differentiates between brute force attacks, characterized by a high volume of failed attempts against one or more users from a single source, and password spraying, indicated by multiple unique usernames failing authentication from the same source.
Page 2 of 38