Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
780 detections
Filters
Last updated
All Time
Detection languages
429
116
112
63
22
Contributors
176
85
81
80
70
Categories
20,443
11,831
5,872
5,155
4,866
780
Platforms
339
222
141
139
71
Products / Services
318
166
85
57
49
MITRE Techniques
413
348
254
231
200
CVEs
5
5
3
2
2
IDS Classtypes
7
2
1
1
1
IDS Protocols
8
2
1
1
Detects unusual number of failed authentications from the same IP for valid users.
Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.
Detects when an Okta user failed a number challenge during push notification.
Detects multiple users login failures from a single IP.
Detects successful login after multiple failed attempts
Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs.
Detects suspicious rejected SMB guest logon attempts from an IP address, which can be an indicator of an attempted PrintNightmare (CVE-2021-1675) remote code execution exploit or other brute-force/password guessing attacks against SMB. The rule specifically looks for EventID 31017 (SMB client security event for rejected guest logon) where the UserName is empty and the ServerName starts with '\1', which is often seen in exploit attempts.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
This rule detects NTLM brute force attempts by identifying specific workstation names commonly used by NTLM brute-forcing tools. It looks for Event ID 8004 in the Microsoft-Windows-NTLM/Operational log, specifically when the 'WorkstationName' field matches a list of known tool-related or generic Windows names.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Detects failed Kerberos TGT issue operations. This can be a sign of manipulations of TGT messages by an attacker, potentially indicating attempts to exploit Kerberos for credential access or to bypass authentication mechanisms.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
Detects Label Distribution Protocol (LDP) authentication failures on Cisco devices, which could indicate an adversary attempting to brute force LDP authentication to manipulate MPLS labels. This could be part of an effort to disrupt network traffic or gain unauthorized access.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
This rule detects when an authenticated user, who is not authorized for remote logon, attempts to connect to a computer via Remote Desktop. This event can indicate an attacker attempting to discover and access available Windows servers on the network.
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Alerts on Metasploit host's authentications on the domain.
Indicates sign-in from a malicious IP address based on high failure rates.
Page 37 of 38